I've asked before if some kind of canonical encoding should be used on the input parameters of SHA-3 before it could be used as replacement for HMAC.
However, if I read the current NIST specifications in NIST SP 800-185 correctly, there is no
Keypack function defined. The
Keypack function prefixed a key size to the key so that the key and message data are kept separate. Currently the key just seems to be zero-padded up to the next block boundary using the function
bytepad(encode_string(K), 168) for KMAC128 and
bytepad(encode_string(K), 136) for KMAC256.
Does that mean that there is no canonical encoding for key and data? Is it safe to use a dynamically sized key and data within KMAC so that
bytepad(encode_string(K), 136) || X != bytepad(encode_string(K'), 136) || X' for
K != K?