By SHAKE256_256, I mean taking first 256 bits of the output of SHAKE256
i.e. SHAKE256_256(M) = SHAKE256(M,256)
What is the motivation of choosing SHAKE256_256 instead of SHA3-256 in XMSS and SPHINCS. Are there any advantages of SHAKE256_256 over SHA3-256.
As far as I know, they both have 24 rounds keccak with instantiations
SHA3-256(M) = Keccak(M || 01, 256) SHAKE256(M, 256) = Keccak(M || 1111, 256)
Why is SHA3-256 avoided in hash based signatures?