Keccak vs Keccak-f permutation in cns008

Question

Keccak is mentioned in cns008 (the cryptonight hash description) in two ways: First in section 3 (Scratchpad Initialization) as Keccak, and another time in section 5 (Result Calculation) as Keccak-f (the Keccak permutation).

It seems to suggest that the modified state from the original Keccak function is used as the whole input to another unique Keccak calculation, but the change to Keccak-f makes it seem like there is something special about it.

What is the difference between these two references, if any?

https://cryptonote.org/cns/cns008.txt

Answer 1

There is a difference between keccak and keccak-f in the spec.

In monero's cryptonight implementation, keccakf is a function that is used by keccak in a loop. It is the function that performs a single hash permutation on the keccak state and modifies it.

Because it accepts the existing keccak state (a 25 member collection of 64 bit integers, or 1600 bits), it is able to use the existing state object of the previous full keccak function. By this point in the process, the existing keccak state has been modified between bytes 64 and 191. The new version of the state object is used as the input to the keccakf function rather than as input to the full keccak function. This is why it is phrased differently in the spec.