10
$\begingroup$

Where did SHAKE128 and SHAKE256 originate from?

I am trying to find them in the original Keccak documentation but can't find them.

Is it some special mode of Keccak referenced in the documentation? Or something invented by NIST and added to the SHA3 standard?

Any public cryptanalysis done on them?

$\endgroup$
  • $\begingroup$ As per the answer, they are NIST's version of an XOF. The number after SHAKE refers to the security level provided by the capacity of the sponge function. $\endgroup$ – Richie Frame Oct 21 '14 at 8:23
  • 2
    $\begingroup$ XOF: extended output function $\endgroup$ – David 天宇 Wong Sep 5 '16 at 21:54
8
$\begingroup$

Where did SHAKE128 and SHAKE256 originate from?

They follow from the general properties of the sponge construction. A sponge function can generate an arbitrary length of output. The submission of Keccak to the SHA-3 competition proposed a single "XOF" (extendable-output function) with a user defined length, which would have been essentially SHAKE-288. NIST seems to have decided on two instead, with more "normal" security levels.

Any public cryptanalysis done on them?

Anything on the generic Keccak function may also apply to them. I don't know of any cryptanalysis specifically on the XOFs, beyond what was done by the authors themselves in the submissions and the site I linked above. However, a comment (pdf) to the draft standard complains that the usage of XOFs (i.e. SHAKEs) is not defined well enough and that their security claim is not very rigorously stated.

$\endgroup$
  • $\begingroup$ I have comments on the comment @otus is referring to: As a hash function, if you extend the output, you don't get any more secure bits. Shortening the output does degrade the security, and that should be intuitively obvious. The comment takes issue with using it as a KDF etc., and NIST essentially says "we didn't really address that use case, and we'll get to it in a special publicaion" (liberally paraphrased). So just keep in mind that changing your output length may not have the exact effect you think it does, and NIST only really approved its use as a fixed length hash function initiall $\endgroup$ – Derrek Bertrand Mar 17 '18 at 18:08
  • $\begingroup$ @DerrekBertrand, true, but since then they have published guidance for using them in other contexts: nvlpubs.nist.gov/nistpubs/specialpublications/… $\endgroup$ – otus Mar 22 '18 at 6:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.