Keccak - as used in SHA-3 / SHAKE amongst others - can also be used for authenticated encryption.
However, there already seem multiple schemes defined for it, including their own implementations:
-
- Kejte Jr;
- Kejte Sr;
- Kejte Minor and
- Kejte Major
Kravatte (excluding the deprecated/broken schemes):
- Kravatte-SANE and
- Kravatte-SANSE (SIV)
-
- River Keyak;
- Lake Keyak;
- Sea Keyak;
- Ocean Keyak and
- Lunar Keyak.
Motorist (based on Keyak, same paper)
So why are there so many different authentication schemes, how do they differ? Kravatte is part of an embedded framework that provides a single function for everything, but there seems to be no explanation why Ketje exists next to Keyak, or why Motorist doesn't completely replace Keyak.
Are there any objective reasons to choose one over the other? Which one, for instance, would be a good generic AEAD scheme to use together with a PQC KEM?