Questions tagged [xof]
An extendable-output function (XOF) is similar to a hash function, but uses the internal state to output a stream of bits instead of a fixed-length octet string.
23
questions
19
votes
2
answers
7k
views
Use case for extendable-output functions (XOF) such as SHAKE128/SHAKE256
FIPS 202 defines 2 functions, SHAKE128 and SHAKE256, as extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks:
it is possible to use an XOF as a hash ...
10
votes
2
answers
957
views
Functional difference between stream cipher, XOF, seed expander, KDF, etc
This question is a request for terminology clarification.
In a canonical XOF interface, the output can be extended as much as needed, but does input has to be variable-length or can be fixed-length ...
10
votes
1
answer
2k
views
What is an extendable output function?
The standardization of SHA-3 included the specification of two functions, SHAKE128 and SHAKE256. Both SHAKEs are referred to as extendable output functions, but what makes a function an extendable ...
7
votes
2
answers
598
views
Will a SHAKE128 stream cipher be vulnerable to related key attacks?
Suppose that SHAKE is seeded with key concatenated to an IV, will the 'key' stream produced by SHAKE128 vulnerable to related key attacks like RC4 is?
My guess is no because seed is already "...
6
votes
2
answers
412
views
FIPS 202/SHAKE: insecure 3DES key derivation example
I'm trying to understand the following passage from FIPS 202 (the SHA-3 standard), discussing the SHAKE functions' correlated outputs for different output lengths and the risks they induce in some ...
5
votes
1
answer
870
views
Can MGF1 within OAEP and PSS be replaced by a XOF?
Do we still need MGF1 as used in the PKCS#1 v2.x specifications for SHA-3 hash functions? MGF1 is currently used for OAEP and PSS as Mask Generation Function. Now that the SHA-3 specification contains ...
3
votes
1
answer
177
views
Questions: Argon2, its internal state and security of it when generating keys larger than 256/512 bits
Let's suppose I want to use a cipher with a large key size, such as ISAAC that supports 8192 bits ogf key.
I can hash with sha-256 or sha-512 and iterate until reaches the key size but I won't get ...
2
votes
2
answers
530
views
What is the difference between a seeded RNG and an XOF hash?
Suppose I have some ZK proofs that were turned non-interactive using Fiat-Shamir heuristic. So I need to generate the challenge value deterministically using some data shared between the prover and ...
2
votes
3
answers
488
views
Are XOFs and KDFs more usable than DRBGs?
CSPRNGs have 2 design requirements:
output unpredictability,
back-tracing resistance.
In addition to which, NIST SP 800-90Ar1 added other features such as a) instance customization/personalization,...
2
votes
1
answer
391
views
Why XOFs are more convenient than Hash Functions in modeling Random Oracles
In this answer, it is mentioned that
Easier instantiation of random oracles. Some security proofs rely on the so-called random oracle model to prove the security of a given scheme. Normally you'd ...
2
votes
1
answer
187
views
Number of rounds for constant header size in common hashes and XOFs
We compute hash $H(M_0\mathbin\|M_1)$ of size $d\ge1$ for some constant header $M_0$ of size $m_0$, and $\nu\ge1$ messages $M_1$ of random content and size $m_1$.
For Merkle-Damgård hashes, a simple ...
2
votes
1
answer
146
views
SHAKE256 XOF: Absorb incrementally vs all at once
I'm diving into SHAKE256's XOF (Extendable Output Function), and I've got a bit of a head-scratcher.
I'm wondering if there's any difference between incrementally absorbing bytes and absorbing ...
2
votes
1
answer
351
views
Can any hash function based on the sponge construction work as extendable output function?
Keccak provides a sort of very useful XOFs.
Can other sponge construction hash function like Spongent work as XOF?
Is there any lightweight XOF for hardware or software implementation?
2
votes
0
answers
67
views
Is it possible to use a XOF function as csrng? [duplicate]
Let's say we "seed" a xof function (eg. SHAKE256) with x cryptographically random bytes (enough so that they can't be bruteforced), could said function be used as a cryptographically secure random ...
2
votes
0
answers
190
views
Using NIST constructions based on Keccak like cSHAKE128 for other sponges
NIST defines a lot of interesting applications of sponges in FIPS 202 and NIST SP 800-185 like the XOF cSHAKE128 or the MAC scheme KMAC.
All this schemes come with a security guarantee and are ...
1
vote
1
answer
100
views
Is it safe to derive a Falcon512 key pair from a XOF output?
I'm working on a program that requires multiple key pairs from multiple algorithms to be derived from a single 128-byte master seed. However, I couldn't find an implementation for Falcon512 that ...
1
vote
1
answer
114
views
Matrix parsing in kyber
In the Kyber specification the parse function (algorithm 1 on page 6) takes as input a non-terminating byte stream. Although unlikely, an unlimited number of bytes ...
1
vote
1
answer
140
views
Should the cSHAKE customization string ever be attacker-controlled?
On first glance, the optional customization string for cSHAKE resembles the optional salt input to HKDF-Extract. Indeed, the Noise Protocol Framework initially uses a protocol identifier string as its ...
1
vote
0
answers
57
views
Is the security of output of Skein when using arbitrary output size similar to that of SHAKE?
Let's suppose I have a 1MB high-resolution photo and I want to hash and create a 1536-bits key.
I know that I could just use SHAKE-256 as its a pre-enginered way for doing that.
There is also Skein ...
1
vote
0
answers
88
views
Exact security requirements for extendable output functions (XOF)?
In the FIPS202 document "SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions" an extendable-output functions is defined as:
An extendable-output function (XOF) is a ...
0
votes
1
answer
59
views
Output a pad (un-keyed, variable length) from an input seed (fixed value for same seed)
I want a function $y = f(x, len)$:
$x$ is the seed. $y$ is the output. $len \in \mathbb{Z^+}$ is the length (bytes) of $y$
Select a seed string $x$ to generate a string $y$.
For each same pair of $x$ ...
0
votes
1
answer
220
views
RSA-KEM: minimal number of random bits
I've already asked a few - as yet officially unanswered - questions about RSA-KEM with regards to the input secret encrypted using the public key here and (less on topic for this question) here.
...
0
votes
0
answers
27
views
Can salt and XOF be used to create a symmetric cipher? [duplicate]
I'm new to crypto, and I've got an idea and I want to get some feedback if it's even a right direction. Let's say that I create a symmetric cipher by using an XOF with a salt and a secret key.
...