Are there any restrictions on the specified output length when using shake-128 or shake-256, to the extent that certain output lengths should be avoided/or not used entirely?


If someone decided to declare an output length equal to 1600 bits would there be a full block showing? If yes, is this of any concern?

Is there any issue with SHAKE-256(message,output_size_in_bits)=SHAKE-256(message,1600)

  • $\begingroup$ You need to distinguish between the total output size,which is practically unlimited, and the output size per iteration, which has a fixed limit (I'd guess $1600 - 2 \cdot 128$ for SHAKE-128). $\endgroup$ Aug 7, 2017 at 17:13
  • $\begingroup$ I'm referring to total output size. ie SHAKE-256(message,output_size) And interested in a total output size of 1600 bits. ie SHAKE-256(message,1600). How that block gets sliced and passed to extend the output past 1600 bits should be considered after checking at 1600 bits. $\endgroup$
    – Q-Club
    Aug 7, 2017 at 17:29
  • $\begingroup$ @CodesInChaos why is the output unlimited? Will there ever be a situation where a full 1600 bit output from keccak forms at least a portion of a SHAKE-256 output? $\endgroup$
    – Q-Club
    Aug 7, 2017 at 17:38
  • $\begingroup$ Have you read up on how the sponge construction works? $\endgroup$ Aug 7, 2017 at 18:45

1 Answer 1


There is no standard limit on the output of SHAKE256. No matter what output size you use, SHAKE256 advertises collision, preimage, and second-preimage resistance up to a 256-bit security level against a classical adversary, and up to a 128-bit security level against a quantum adversary, limited by the size of the output for small outputs (see Table 4 in Appendix A of the SHA-3 standard for details).

In particular, you are not limited to a 1600-bit output. SHAKE256-$d$ does not simply reveal up to $d$ bits of the state and stop at 1600. Rather, it reveals up to 1088 bits of the 1600-bit state, then permutes the state, and repeats until it has produced $d$ bits. In spongy lexicon, it repeatedly squeezes up to 1088 bits at a time out of the sponge after absorbing the input. It leaves 512 bits of the state secret at each iteration, far more than an adversary could ever hope to find even with a quantum computer.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.