[noise] Lightweight ciphers and Noise

[David Wong]

> SHA3 is pretty RAM hungry - 400 bytes of permanent state and another 400 bytes of stack when the core block operation is evaluated

Just want to point out that keccak (and thus Strobe and Disco) offer
sponges/duplexes of different sizes[1]: a 1600-bit, 800-bit and
400-bit version.

It also sounds like the number of rounds in keccak could be halved to
12 rounds to speed up the implementation. This is what has been done
by the keccak team itself with KangarooTwelve[2]

[1]: https://strobe.sourceforge.io/specs/#instances
[2]: https://crypto.stackexchange.com/questions/46523/why-does-kangarootwelve-only-use-12-rounds

David