That's not true: https://github.com/gvanas/KeccakCodePackage/blob/master/Stan...
1) How does not having SHR makes it easier to audit?
2) how are sha-3 implementations actually using SHR not making the parent's comment moot?
Another fun one is x ^= x >> n with n some strictly positive constant, this is also invertible. It's used a lot in the murmurhash family of non-cryptograhic hash functions.
The inverse is also required for decryption: If you encrypt as ciphertext = permutation(plaintext + key), decryption is plaintext = inverse(ciphertext) - key.
> The inverse is also required for decryption: If you encrypt as ciphertext = permutation(plaintext + key), decryption is plaintext = inverse(ciphertext) - key.
This is not how encryption/decryption works with Keccak. Keccak is used to create a stream (it is then XORed with the plaintext or ciphertext).
1) it forces you to allocate more memory (to do the Davies-Mayer construction)
2) it complicates the security analysis because you get collisions (if you do not use a permutation, it means you have an injective construction)
screenshot here: http://i.imgur.com/4xncceB.png