Reasoning behind SHA-3 state array indexing I was reading through the SHA3 standard (https://dx.doi.org/10.6028/NIST.FIPS.202) and in the standard it defines how to construct 3D state array from a 1D array.
The state array is defined as follows:

For all triples (x, y, z) such that 0 ≤ x &lt; 5, 0 ≤ y &lt; 5, and 0 ≤ z &lt;
w,
A[x, y, z] = S [w(5y + x) + z]

This indexing is a bit cumbersome because in some sense, y &gt; x &gt; z (I can clarify what I mean if requested). I think it would be more natural to swap the x and y indices and defined it as:

A[x,y,z] = S [w(5x + y) + z]

Is there a reason for the definition in the standard?
First let us have a look at the state representation.




  For all triples $(x,y,z)$ such that $0 \le x &lt; 5$, $0 \le y &lt; 5$, and $0 \le z &lt; w$, $$A[x,y,z]=S[w(5y+x)+z].$$
  For example, if $b = 1600$, so that $w = 64$, then

A[0,0,0] = S[0]     A[1,0,0] = S[64]     A[4,0,0] = S[256]
A[0,0,1] = S[1]     A[1,0,1] = S[65]     A[4,0,1] = S[257]
A[0,0,2] = S[2]     A[1,0,2] = S[66]     A[4,0,2] = S[258]

A[0,0,61] = S[61]   A[1,0,61] = S[125]   A[4,0,61] = S[317]
A[0,0,62] = S[62]   A[1,0,62] = S[126]   A[4,0,62] = S[318]
A[0,0,63] = S[63]   A[1,0,63] = S[127]   A[4,0,63] = S[319]

and

A[0,1,0] = S[320]   A[1,1,0] = S[384]     A[4,1,0] = S[576]
A[0,1,1] = S[321]   A[1,1,1] = S[385]     A[4,1,1] = S[577]
A[0,1,2] = S[322]   A[1,1,2] = S[386]     A[4,1,2] = S[578]

A[0,1,61] = S[381]  A[1,1,61] = S[445]    A[4,1,61] = S[637]
A[0,1,62] = S[382]  A[1,1,62] = S[446]    A[4,1,62] = S[638]
A[0,1,63] = S[383]  A[1,1,63] = S[447]    A[4,1,63] = S[639]



If you look into the position of the bits. you notice that you can consider your state as an array of $\texttt{u_int64}$ (numbering $0 \to 63$, $64 \to 127, \ldots$), this explains the $w$ in the formula.

If you look at the ordering of the bits, you notice that we have the first plane ($y = 0$), then the second etc. Thus taking the 320 first bits select the first plane and so on.

Now if you look at the operations in Keccak:


$\iota$ operate on the lane $(0,0)$,
$\theta$ operates on column but depends on the parity of its neighbor columns,
$\pi$ and $\rho$ operates directly on the lane position
$\chi$ is applied to a row.


$\chi$ can also be seen as a 5-bits S-box that has been bit-sliced and to be applied $64$ times in parallel (see bellow).



We can thus select 320 bits and apply $\chi$ directly, the bits are grouped in such way that loading them consecutively will be fast (instead of fetching them at different positions). So we have a first reason to prefer this ordering.

Then we can have a look at $\theta$, it works mainly on columns but you can also consider doing it directly on planes (thus 320 times in parallel !).



Thus selecting the states by bloc of 320 bits and adding them from a vector point of view makes it fast.

We thus have here two operations ($\theta$ and $\chi$) which benefit greatly from the $w(5y+x)+z$ ordering.

Now if you assume the other ordering ($w(5x+y)+z$), notice that:


you have to fetch bits from 5 different position when you want to apply $\chi$.
you can only work on $\theta$ with a parallelism over the column and not the slate anymore.


TL;DR: $\chi$ and $\theta$ parallelism benefits a lot from this ordering (and also from a hardware point of view).