Skip to main content
1 of 3
Jeremy Banks
  • 855
  • 2
  • 10
  • 25

It’s not possible. Among other issues, section 6.3 of the SHA-3 paper describes how distinct bits are appended to the message in SHAKE mode to explicitly create domain separation that would prevent digests from normal SHA-3 from being equivalent to those created during SHAKE operations:

The bolded suffix (i.e., 11) supports domain separation: it distinguishes the inputs to KECCAK[c] that arise from RawSHAKE128 and RawSHAKE256 from the inputs arising from the SHA-3 hash functions defined in Sec. 6.1, as well as other domains that may be defined in the future.

Jeremy Banks
  • 855
  • 2
  • 10
  • 25