# Output a pad (un-keyed, variable length) from an input seed (fixed value for same seed)

I want a function $$y = f(x, len)$$:

1. $$x$$ is the seed. $$y$$ is the output. $$len \in \mathbb{Z^+}$$ is the length (bytes) of $$y$$
2. Select a seed string $$x$$ to generate a string $$y$$.
3. For each same pair of $$x$$ and $$len$$, the value of $$y$$ is same.
4. seed should have a reasonable short length. $$y$$'s length may support a certain range (*remark)
5. Every byte value of $$y$$ should be uniformly (or close to uniformly) distributed

Remark of 4 - please consider two possible functions:

1. $$y$$ length is a multiple of $$16$$ (block length $$16$$). If I use hash function, the problem is that the length options are limited and not consecutive (e.g., $$16 \cdot n$$, $$n=1, 2, 3,\ldots$$).
2. $$y$$ can be any length within a range

(No need to protect $$f(x)$$ as a secret)

• You cod truncate the output from multiple hash invocations. If you view (key, nonce) as x then this essentially asks for a stream cipher (like ChaCha or AES-CTR) or alternatively for a kdf supporting key expansion (like HKDF) – SEJPM Aug 7 at 8:59

It sounds like the SHAKE functions (there are two flavors, SHAKE-128 and SHAKE-256) are designed to do exactly what you're asking for.

SHAKE takes a value ($$x$$ in your case), and generates an arbitrarily long output from it. You can take the first $$len$$ bytes from it, and that's your $$y$$

1. For each same pair of $$x$$ and $$len$$, the value of $$y$$ is same.

For any input seed $$x$$, SHAKE always generates the same key stream. This does mean that (for example) $$\text{SHAKE}( \text{"abc"}, 128 )$$ is a prefix of $$\text{SHAKE}( \text{"abc"}, 256 )$$. Your requirements didn't mention that as a concern, but if it is, you can always use $$x || len$$ as the input to SHAKE

1. seed should have a reasonable short length.

SHAKE can handle any seed length you want.

4a. $$y$$'s length may support a certain range (*remark)

SHAKE can generate any length of output

1. Every byte value of $$y$$ should be uniformly (or close to uniformly) distributed

As far as we know, the output of SHAKE is uniformly distributed.

And while it's not difficult at all to generate the same functionality from a fixed length hash function, the nice thing about SHAKE is that all the logic about generating multiple hashes and truncating the last one is already done for you.

Here is the standard implementation of SHAKE (as well as a number of related functions)