16
$\begingroup$

Where did SHAKE128 and SHAKE256 originate from?

I am trying to find them in the original Keccak documentation but can't find them.

Is it some special mode of Keccak referenced in the documentation? Or something invented by NIST and added to the SHA3 standard?

Any public cryptanalysis done on them?

$\endgroup$
2
  • $\begingroup$ As per the answer, they are NIST's version of an XOF. The number after SHAKE refers to the security level provided by the capacity of the sponge function. $\endgroup$ Oct 21, 2014 at 8:23
  • 2
    $\begingroup$ XOF: extended output function $\endgroup$ Sep 5, 2016 at 21:54

1 Answer 1

9
$\begingroup$

Where did SHAKE128 and SHAKE256 originate from?

They follow from the general properties of the sponge construction. A sponge function can generate an arbitrary length of output. The submission of Keccak to the SHA-3 competition proposed a single "XOF" (extendable-output function) with a user defined length, which would have been essentially SHAKE-288. NIST seems to have decided on two instead, with more "normal" security levels.

Any public cryptanalysis done on them?

Anything on the generic Keccak function may also apply to them. I don't know of any cryptanalysis specifically on the XOFs, beyond what was done by the authors themselves in the submissions and the site I linked above. However, a comment (pdf) to the draft standard complains that the usage of XOFs (i.e. SHAKEs) is not defined well enough and that their security claim is not very rigorously stated.

$\endgroup$
2
  • $\begingroup$ I have comments on the comment @otus is referring to: As a hash function, if you extend the output, you don't get any more secure bits. Shortening the output does degrade the security, and that should be intuitively obvious. The comment takes issue with using it as a KDF etc., and NIST essentially says "we didn't really address that use case, and we'll get to it in a special publicaion" (liberally paraphrased). So just keep in mind that changing your output length may not have the exact effect you think it does, and NIST only really approved its use as a fixed length hash function initiall $\endgroup$ Mar 17, 2018 at 18:08
  • $\begingroup$ @DerrekBertrand, true, but since then they have published guidance for using them in other contexts: nvlpubs.nist.gov/nistpubs/specialpublications/… $\endgroup$
    – otus
    Mar 22, 2018 at 6:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.