2
$\begingroup$

In the FIPS202 document "SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions" an extendable-output functions is defined as:

An extendable-output function (XOF) is a function on bit strings (also called messages) in which the output can be extended to any desired length.

That is all the definition I could find on that. However, this definition does not capture the notion that the bits should be pseudorandom or any other security requirements. The way I saw XOF functions used (in Dilithium, for example) and the way they are designed, they fulfill additional security requirements, most notable being indistinguishable from pseudorandom functions.

Are those additional security requirements spelled out somewhere? When a paper/cryptographic algorithm uses an XOF somewhere, what are the implicit security assumptions that the XOF should fulfill?

Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ Most papers will explicitly spell the security notions out for their XOFs which will also be more concrete than the quoted one. Otherwise, I would probably expect Random Oracle or CRHF like properties from a SHAKE XOF (with appropriate restrictions to block truncation based attacks). $\endgroup$
    – SEJPM
    Commented Oct 22, 2021 at 11:16

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.