I was studying the cryptographic "evolution" of IOTA from Curl to Troika and I noticed something in Kerl hash function.

Kerl is an adaptation of Keccak384 which works with trits but it introduces some big changes. In particular a major difference can be found in the squeezing phase. Here is the pseudocode for it:

def squeeze(length): if length not a multiple of 243: throw "Illegal length" while has trits to fill: bytes = self.k.digest() trits.copy(convertToTrits(bytes)) #offset in used as in Curl trits[242] = 0 #avoid conversion undefined edge-case self.k.reset() # [1] for byte in bytes: byte = ~byte #flip bits self.k.update(bytes)

  • Why is the sponge reset after each block is squeezed?
  • Why are the bytes flipped each time?

The only place in which more than a block is squeezed is the private key generation.

  • How does this changes affect the relation between the key segments?
  • Is there an increased correlation? Shouldn't this be a problem?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.