Keccak-256

Keccak-256 is built on the sponge construction of the Keccak family, designed by Guido Bertoni, Joan Daemen, Michael Peeters and Gilles Van Assche. It runs the Keccak-f[1600] permutation over a 1600-bit state, absorbs the message and then squeezes out a 256-bit output. Keccak won the NIST SHA-3 competition in 2012, and Ethereum adopted it in its KECCAK256 opcode before the standard was finalized.

The point that causes the most confusion is that Keccak-256 is not interchangeable with SHA3-256. The only difference is the domain-separation padding byte: original Keccak uses 0x01 and official SHA3-256 uses 0x06. Same permutation, different output. This happened because NIST changed the padding of the original submission and published FIPS 202 in August 2015, while the Ethereum Yellow Paper specifies the contest-winning Keccak, not the FIPS version.

Keccak-256 underpins three systemic Ethereum mechanisms. An address is the last 20 bytes of the hash of the public key. A function selector is the first 4 bytes of the hash of the signature: keccak256("transfer(address,uint256)") yields 0xa9059cbb. And the storage slots of mappings and arrays are also computed with keccak-256. The EIP-55 address checksum standard relies on it too, which makes this function a structural piece of the entire EVM stack.