Questions tagged [xof]

An extendable-output function (XOF) is similar to a hash function, but uses the internal state to output a stream of bits instead of a fixed-length octet string.

Filter by
Sorted by
Tagged with
19 votes
2 answers
7k views

Use case for extendable-output functions (XOF) such as SHAKE128/SHAKE256

FIPS 202 defines 2 functions, SHAKE128 and SHAKE256, as extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks: it is possible to use an XOF as a hash ...
Hauleth's user avatar
  • 326
5 votes
1 answer
874 views

Can MGF1 within OAEP and PSS be replaced by a XOF?

Do we still need MGF1 as used in the PKCS#1 v2.x specifications for SHA-3 hash functions? MGF1 is currently used for OAEP and PSS as Mask Generation Function. Now that the SHA-3 specification contains ...
Maarten Bodewes's user avatar
  • 92.6k
2 votes
3 answers
491 views

Are XOFs and KDFs more usable than DRBGs?

CSPRNGs have 2 design requirements: output unpredictability, back-tracing resistance. In addition to which, NIST SP 800-90Ar1 added other features such as a) instance customization/personalization,...
DannyNiu's user avatar
  • 9,207
7 votes
2 answers
605 views

Will a SHAKE128 stream cipher be vulnerable to related key attacks?

Suppose that SHAKE is seeded with key concatenated to an IV, will the 'key' stream produced by SHAKE128 vulnerable to related key attacks like RC4 is? My guess is no because seed is already "...
DannyNiu's user avatar
  • 9,207
6 votes
2 answers
414 views

FIPS 202/SHAKE: insecure 3DES key derivation example

I'm trying to understand the following passage from FIPS 202 (the SHA-3 standard), discussing the SHAKE functions' correlated outputs for different output lengths and the risks they induce in some ...
Luis Casillas's user avatar
3 votes
1 answer
178 views

Questions: Argon2, its internal state and security of it when generating keys larger than 256/512 bits

Let's suppose I want to use a cipher with a large key size, such as ISAAC that supports 8192 bits ogf key. I can hash with sha-256 or sha-512 and iterate until reaches the key size but I won't get ...
phantomcraft's user avatar
2 votes
1 answer
187 views

Number of rounds for constant header size in common hashes and XOFs

We compute hash $H(M_0\mathbin\|M_1)$ of size $d\ge1$ for some constant header $M_0$ of size $m_0$, and $\nu\ge1$ messages $M_1$ of random content and size $m_1$. For Merkle-Damgård hashes, a simple ...
fgrieu's user avatar
  • 141k