How is Keccak calculated in Monero?

Question

I am reading the monero's implementation of Keccak (used as first part of slow_hash) in src/crypto/keccak.c

I have found that it is a Keccak-256 (with b=1600, c=512, r=1088) and "output" of 1600 bits (is this really keccak's output or only internal state?).

I tried to compare it with simple Python implementation Keccak.py, but the final result is not the same (in fact, first 136 bytes of output are the same, they differ only in the remaining 64). I used myKeccak.Keccak((len(s)*4,s),1088,512,1600,True) command. However the state after "Value after absorption" is correct! It is the same as output from monero's keccak1600() function.

Looking at the Keccak.py sources, does this mean that monero's implementation omits the squeezing part of Keccak? I don't think so as I can see invocation of keccakf() on 2 places in keccak.c. Then how is it possible that the final result of python implementation is not correct, but the state before squeezing is?

EDIT: I am asking about the Keccak implementation which is used as first part of slow_hash (during mining), which produces 1600 bits of output.

Answer 1

The keccak1600 function used by Monero is based on Keccak-256 (b=1600, c=512, r=1088 and output of 256 bits, not 1600 bits), but it returns the whole internal state (1600 bits) instead of the first 256 bits of the internal state.

The "squeezing phase" present in Keccak.py doesn't appear in Monero's keccak.c file because in this particular case it has no effect.

The reason why there are two places where the keccakf function is called is because in monero's keccak.c, most of the message is hashed in the for loop (first keccakf), then the remaining bytes of the message are padded and hashed (second keccakf).

In mininero's Keccak.py, the message is padded first, then the padded message is hashed completely (first keccakf in the for loop). The second keccakf (in the "squeezing phase") will never be called given the parameters used for monero (n = 256, r = 1088).