Beyond the Event Horizon of Keccak, Extending the Observation from 2011 and applications

What it is

A October 2026 ePrint preprint (2026/2671) by Danilo Gligoroski extends the author's 2011 observation about the Keccak sponge. The observation: one path from a state with all-zero capacity bits back to such a state gives an infinite family of second preimages for every message of at least one full rate block. The path costs about 2^(c/2), so it is infeasible for SHA3-256 (c=512). The paper does not break SHA-3. Its practical content is a set of generic-sponge constructions with feasible demos at small capacity, plus protocol proposals that use a deliberately small capacity.

How it works

• Theorem 1: the capacity can have any value x. A two-block meet-in-the-middle loop from x back to x costs about 2·2^(c/2) (heuristic) and gives the same unlimited second-preimage family with no further search. Connectors into and out of x cost about the same again.
• Theorem 2: the construction extends to k-block loops and to cycles of the capacity map. A single-state "bridge" (a state S with cap(f(S)) = cap(f^-1(S))) also works, but costs about 2^c.
• Theorem 3: one inner collision plus one connector give equal-length Joux-style 2^k multicollisions for every k. Joux's method needs k separate collision searches. The author believes this is the first such construction for generic sponges with search cost independent of k.

Preconditions / Affected

The generic attack cost scales as 2^(c/2), so SHA3-256 (c=512) stays out of reach. Verified full-round examples exist only on Keccak-f[200] and on Keccak-f[1600] with c=32, which is a reduced-capacity variant and not a standardized SHA-3 instance. Anyone using Keccak with a small capacity, or a custom sponge parameterization, is the relevant audience.

What to do

The page gives no patches or commands. It states that the theorems are proven, the algebraic results are machine-checked in Lean 4, and reproducible experiments and open-source proof-of-concept code are provided. An engineer can use those to check the small-capacity examples. Treat any design with reduced capacity as exposed to cheap second preimages and multicollisions.

Caveats

The second part proposes protocols built on the cost gap between minting and forging bridges: proof of work with hardness-adaptive capacity, dual-capacity commitments anchored by the real SHA3-256 digest, bridges as zero-knowledge-committed tokens, and a bounty market for reduced-round security. The author states these are design proposals whose end-to-end security remains open. The 2^(c/2) cost for Theorem 1 is heuristic. The page does not report concrete runtimes.