In this answer, it is mentioned that
Easier instantiation of random oracles. Some security proofs rely on the so-called random oracle model to prove the security of a given scheme. Normally you'd use some artificial construction around a fixed-size hash function to get the desired output size, but with XOFs you can just plug them right in without having to fear any mistakes on your side potentially breaking the proofs (most people don't know/understand in many cases, me included).
and NIST.FIPS.202 says
Extendable-output functions are different from hash functions, but it is possible to use them in similar ways, with the flexibility to be adapted directly to the requirements of individual applications, subject to additional security considerations.
- Is it just the fixed-size problem of hash functions? Like in this question Can MGF1 within OAEP and PSS be replaced by a XOF?
Actually, we can create arbitrary length from the hash functions by $h_0 = H(m)$ then $h_i = H(h|i), i>0$ and the output is $h_0\|h_1\|\ldots$ - I'm not claiming this is collision-free.
At page 24 of the NIST document, however, with the section titled as Additional Consideration for Extendable-Output Functions;
XOFs have the potential for generating related outputs—a property that designers of security applications/protocols/systems may not expect of hash functions.
- Why XOFs are better than Hash Functions in modeling Random oracles?