SHAKE-128/256 or SHA3-256/512

Question

Would it be better to use SHAKE-128/256 or SHA3-256/512? In what situation should I chose one over the other?

Answer 1

And in which case would it be more interesting to use one or another?

So SHA3-$n$ offers $n$ bits of security against preimage and second-preimage attacks and $n/2$ bits of security against collision attacks. On the other side SHAKE-$n$ offers at $n$ bits of security against preimage and second-preimage attacks and also $n$ bits of security against collision attacks (assuming the digest is at least $2n$ bits long). So when to use which?

• When you are forced to use "an approved hash function", you use SHA3, because SHAKE doesn't qualify.
• When you need a really long hash output (or an XOF in general), you use SHAKE.
• When you really need more than 256 bits of security against preimage or second-preimage attacks you use SHA3.
• When you want to be compatible with more other systems, you probably want to use SHA3.
• When speed matters to you (and you still want to use SHA3 / SHAKE) and you are happy with an all-arond $n$-bit security level (for $n\in\{128,256\}$), you use SHAKE.

This last point follows from the fact that the higher preimage resistance in SHA3 is paid for with lower rate (=number of new bits processed per internal permutation invocation) which is usually higher in SHAKE than in SHA3 (SHAKE256 has the same as SHA3-256).

Answer 2

You should generally just use SHAKE128, but you should make sure that within your application, you don't use the SHAKE128 hash (to any length) of the same data for two different purposes. For example, prefix each message you hash with an unambiguous description of the purpose for which you are hashing it: $\operatorname{SHAKE128-256}(\text{‘file hash:’} \mathbin\| m)$ and $\operatorname{SHAKE128-512}(\text{‘username hash:’} \mathbin\| u)$.

The main reason for (e.g.) SHA3-256 and SHA3-512 is to provide a mindless upgrade path from SHA-256 and SHA-512 that won't hurt security in the event that you happened to use SHA-256 and SHA-512 hashes of the same string and assumed the hashes to be independent. In contrast, SHAKE128-256 is a prefix of SHAKE128-512 and therefore very much not independent.

Otherwise, SHA3-256 was overdesigned out of paranoia and political reasons—and SHA3-512 even moreso—and is consequently substantially more expensive than SHAKE128 for no meaningful improvement in security. SHAKE128 is conjectured to provide up to the standard 128-bit security level for preimage resistance and collision resistance against all adversaries, classical or quantum. Of course, for 128-bit preimage resistance you need to use at least a 128-bit output, and for 128-bit collision resistance you need to use at least a 256-bit output.

For an additional hedge against modest cryptanalytic advances, like for use with edwards448 instead of edwards25519, you might use SHAKE256.