Questions tagged [xof]

An extendable-output function (XOF) is similar to a hash function, but uses the internal state to output a stream of bits instead of a fixed-length octet string.

Filter by
Sorted by
Tagged with
19 votes
2 answers
7k views

Use case for extendable-output functions (XOF) such as SHAKE128/SHAKE256

FIPS 202 defines 2 functions, SHAKE128 and SHAKE256, as extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks: it is possible to use an XOF as a hash ...
Hauleth's user avatar
  • 326
10 votes
2 answers
957 views

Functional difference between stream cipher, XOF, seed expander, KDF, etc

This question is a request for terminology clarification. In a canonical XOF interface, the output can be extended as much as needed, but does input has to be variable-length or can be fixed-length ...
DannyNiu's user avatar
  • 9,207
10 votes
1 answer
2k views

What is an extendable output function?

The standardization of SHA-3 included the specification of two functions, SHAKE128 and SHAKE256. Both SHAKEs are referred to as extendable output functions, but what makes a function an extendable ...
Melab's user avatar
  • 3,655
7 votes
2 answers
598 views

Will a SHAKE128 stream cipher be vulnerable to related key attacks?

Suppose that SHAKE is seeded with key concatenated to an IV, will the 'key' stream produced by SHAKE128 vulnerable to related key attacks like RC4 is? My guess is no because seed is already "...
DannyNiu's user avatar
  • 9,207
6 votes
2 answers
412 views

FIPS 202/SHAKE: insecure 3DES key derivation example

I'm trying to understand the following passage from FIPS 202 (the SHA-3 standard), discussing the SHAKE functions' correlated outputs for different output lengths and the risks they induce in some ...
Luis Casillas's user avatar
5 votes
1 answer
870 views

Can MGF1 within OAEP and PSS be replaced by a XOF?

Do we still need MGF1 as used in the PKCS#1 v2.x specifications for SHA-3 hash functions? MGF1 is currently used for OAEP and PSS as Mask Generation Function. Now that the SHA-3 specification contains ...
Maarten Bodewes's user avatar
  • 92.6k
3 votes
1 answer
177 views

Questions: Argon2, its internal state and security of it when generating keys larger than 256/512 bits

Let's suppose I want to use a cipher with a large key size, such as ISAAC that supports 8192 bits ogf key. I can hash with sha-256 or sha-512 and iterate until reaches the key size but I won't get ...
phantomcraft's user avatar
2 votes
2 answers
530 views

What is the difference between a seeded RNG and an XOF hash?

Suppose I have some ZK proofs that were turned non-interactive using Fiat-Shamir heuristic. So I need to generate the challenge value deterministically using some data shared between the prover and ...
fjarri's user avatar
  • 289
2 votes
3 answers
488 views

Are XOFs and KDFs more usable than DRBGs?

CSPRNGs have 2 design requirements: output unpredictability, back-tracing resistance. In addition to which, NIST SP 800-90Ar1 added other features such as a) instance customization/personalization,...
DannyNiu's user avatar
  • 9,207
2 votes
1 answer
391 views

Why XOFs are more convenient than Hash Functions in modeling Random Oracles

In this answer, it is mentioned that Easier instantiation of random oracles. Some security proofs rely on the so-called random oracle model to prove the security of a given scheme. Normally you'd ...
kelalaka's user avatar
  • 48.4k
2 votes
1 answer
187 views

Number of rounds for constant header size in common hashes and XOFs

We compute hash $H(M_0\mathbin\|M_1)$ of size $d\ge1$ for some constant header $M_0$ of size $m_0$, and $\nu\ge1$ messages $M_1$ of random content and size $m_1$. For Merkle-Damgård hashes, a simple ...
fgrieu's user avatar
  • 141k
2 votes
1 answer
146 views

SHAKE256 XOF: Absorb incrementally vs all at once

I'm diving into SHAKE256's XOF (Extendable Output Function), and I've got a bit of a head-scratcher. I'm wondering if there's any difference between incrementally absorbing bytes and absorbing ...
Rui 's user avatar
  • 31
2 votes
1 answer
351 views

Can any hash function based on the sponge construction work as extendable output function?

Keccak provides a sort of very useful XOFs. Can other sponge construction hash function like Spongent work as XOF? Is there any lightweight XOF for hardware or software implementation?
Zachary's user avatar
  • 177
2 votes
0 answers
67 views

Is it possible to use a XOF function as csrng? [duplicate]

Let's say we "seed" a xof function (eg. SHAKE256) with x cryptographically random bytes (enough so that they can't be bruteforced), could said function be used as a cryptographically secure random ...
jacobi_matrix's user avatar
2 votes
0 answers
190 views

Using NIST constructions based on Keccak like cSHAKE128 for other sponges

NIST defines a lot of interesting applications of sponges in FIPS 202 and NIST SP 800-185 like the XOF cSHAKE128 or the MAC scheme KMAC. All this schemes come with a security guarantee and are ...
mat's user avatar
  • 2,508
1 vote
1 answer
100 views

Is it safe to derive a Falcon512 key pair from a XOF output?

I'm working on a program that requires multiple key pairs from multiple algorithms to be derived from a single 128-byte master seed. However, I couldn't find an implementation for Falcon512 that ...
Zola Gonano's user avatar
1 vote
1 answer
114 views

Matrix parsing in kyber

In the Kyber specification the parse function (algorithm 1 on page 6) takes as input a non-terminating byte stream. Although unlikely, an unlimited number of bytes ...
Daniel S's user avatar
  • 23.6k
1 vote
1 answer
140 views

Should the cSHAKE customization string ever be attacker-controlled?

On first glance, the optional customization string for cSHAKE resembles the optional salt input to HKDF-Extract. Indeed, the Noise Protocol Framework initially uses a protocol identifier string as its ...
Neil Madden's user avatar
1 vote
0 answers
57 views

Is the security of output of Skein when using arbitrary output size similar to that of SHAKE?

Let's suppose I have a 1MB high-resolution photo and I want to hash and create a 1536-bits key. I know that I could just use SHAKE-256 as its a pre-enginered way for doing that. There is also Skein ...
phantomcraft's user avatar
1 vote
0 answers
88 views

Exact security requirements for extendable output functions (XOF)?

In the FIPS202 document "SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions" an extendable-output functions is defined as: An extendable-output function (XOF) is a ...
cryptobeginner's user avatar
0 votes
1 answer
59 views

Output a pad (un-keyed, variable length) from an input seed (fixed value for same seed)

I want a function $y = f(x, len)$: $x$ is the seed. $y$ is the output. $len \in \mathbb{Z^+}$ is the length (bytes) of $y$ Select a seed string $x$ to generate a string $y$. For each same pair of $x$ ...
TJCLK's user avatar
  • 497
0 votes
1 answer
220 views

RSA-KEM: minimal number of random bits

I've already asked a few - as yet officially unanswered - questions about RSA-KEM with regards to the input secret encrypted using the public key here and (less on topic for this question) here. ...
Maarten Bodewes's user avatar
  • 92.6k
0 votes
0 answers
27 views

Can salt and XOF be used to create a symmetric cipher? [duplicate]

I'm new to crypto, and I've got an idea and I want to get some feedback if it's even a right direction. Let's say that I create a symmetric cipher by using an XOF with a salt and a secret key. ...
Likepineapple's user avatar