By SHAKE256_256, I mean taking first 256 bits of the output of SHAKE256
i.e. SHAKE256_256(M) = SHAKE256(M,256)
What is the motivation of choosing SHAKE256_256 instead of SHA3-256 in XMSS and SPHINCS. Are there any advantages of SHAKE256_256 over SHA3-256.
As far as I know, they both have 24 rounds keccak with instantiations
SHA3-256(M) = Keccak[512](M || 01, 256)
SHAKE256(M, 256) = Keccak[512](M || 1111, 256)
Why is SHA3-256 avoided in hash based signatures?
What is the motivation of choosing SHAKE256_256 instead of SHA3-256 in XMSS and SPHINCS.
For Sphincs+ (SLH-DSA), sometimes there is a need to generate more than 256 bits from a single hash operation; specifically, when we hash the message into a series of FORS leaves, the Merkle leaf and the Merkle tree.
If we were to use SHA3-256, they would need to be a way to generate those additional bits (which we could do - they do it for SHA-2). On the other hand, SHAKE makes it much cleaner (we just squeeze out as many bits as needed), so they went with that.
And, since they're using SHAKE there, there's no reason not to use SHAKE everywhere.
