# Shake 128/256 Output Length Restrictions

Are there any restrictions on the specified output length when using shake-128 or shake-256, to the extent that certain output lengths should be avoided/or not used entirely?

Edit:

If someone decided to declare an output length equal to 1600 bits would there be a full block showing? If yes, is this of any concern?

Is there any issue with SHAKE-256(message,output_size_in_bits)=SHAKE-256(message,1600)

• You need to distinguish between the total output size,which is practically unlimited, and the output size per iteration, which has a fixed limit (I'd guess $1600 - 2 \cdot 128$ for SHAKE-128). Aug 7, 2017 at 17:13
• I'm referring to total output size. ie SHAKE-256(message,output_size) And interested in a total output size of 1600 bits. ie SHAKE-256(message,1600). How that block gets sliced and passed to extend the output past 1600 bits should be considered after checking at 1600 bits. Aug 7, 2017 at 17:29
• @CodesInChaos why is the output unlimited? Will there ever be a situation where a full 1600 bit output from keccak forms at least a portion of a SHAKE-256 output? Aug 7, 2017 at 17:38
• Have you read up on how the sponge construction works? Aug 7, 2017 at 18:45

In particular, you are not limited to a 1600-bit output. SHAKE256-$d$ does not simply reveal up to $d$ bits of the state and stop at 1600. Rather, it reveals up to 1088 bits of the 1600-bit state, then permutes the state, and repeats until it has produced $d$ bits. In spongy lexicon, it repeatedly squeezes up to 1088 bits at a time out of the sponge after absorbing the input. It leaves 512 bits of the state secret at each iteration, far more than an adversary could ever hope to find even with a quantum computer.