Is KangarooTwelve hash function suitable for generating very large key material as Shake-256 is?

Question

If I take a large truly random portion of data, I know that I can generate a 2048-bits key with it (assuming the random data has more entropy than the key). I read in this forum that Shake-256 has this ability.

I also read in Wikipedia this: "KangarooTwelve and MarsupilamiFourteen are Extendable-Output Functions, similar to SHAKE, therefore they generate closely related output for a common message with different output length (the longer output is an extension of the shorter output)."

May I use KangarooTwelve to generate very large keys as well as I can do with Shake-256?

Answer 1

Sure. They are XOF's just like SHAKE128 and SHAKE256. However, if you'd want to use a non-standardized, reduced round, parallel hash function for key derivation is another question. 2048 bits is still relatively small amount of data, and performance should probably not be the first property for this kind of use case.

You would normally expect that a symmetric key contains a high amount of entropy. It is however questionable if that would also be a requirement for 2048 bit key. Generally there is little reason to use more entropy than the system can deliver, which is why it is possible to use a 128 bit seed for e.g. RSA-3072 or lower. 256 bits of security is generally plenty.

Using a XOF that is limited to a security level of 128 or 256 bits makes no sense if you want to achieve true 2048 bits of security, even if such a key has no practical use itself.