What security do Cryptographic Sponges offer against generic quantum attacks?
Unless Keccak has structural weaknesses that I am not aware of, the answer is surprisingly neither 128 nor 256!
Gilles Brassard, Peter Høyer, and Alain Tapp describe a sort of quantum birthday attack in their paper &quot;Quantum Cryptanalysis of Hash and Claw-Free Functions&quot; that effectively works by creating a table of size $\sqrt[3]{2^b}$ (versus the $\sqrt{2^b}$ for the classic birthday attack) and then utilizes Grover's algorithm to find a collision.
While the classic birthday attack thus requires ${\mathcal O}\left(\sqrt{2^b}\right)$ time and memory, the quantum birthday attack only requires ${\mathcal O}\left(\sqrt[3]{2^b}\right)$ time and memory.
This means that to provide a $b$ bit security level against quantum adversaries, a hash function must provide at least a $3b$ bit output.
In your case of 512-bit Keccak, your security level would be $170\frac{2}{3}$.