In this answer, it is mentioned that
Easier instantiation of random oracles. Some security proofs rely on the so-called random oracle model to prove the security of a given scheme. Normally you'd use some artificial construction around a fixed-size hash function to get the desired output size, but with XOFs you can just plug them right in without having to fear any mistakes on your side potentially breaking the proofs (most people don't know/understand in many cases, me included).
and NIST.FIPS.202 says
Extendable-output functions are different from hash functions, but it is possible to use them in similar ways, with the flexibility to be adapted directly to the requirements of individual applications, subject to additional security considerations.
- Is it just the fixed-size problem of hash functions? Like in RSA-PSS?
When looking at page 24 with section title Additional Consideration for Extendable-Output Functions Nist;
XOFs have the potential for generating related outputs—a property that designers of security applications/protocols/systems may not expect of hash functions.
We can create arbitrary length from the hash functions by $h_0 = H(m)$ then $h_i = H(h|i), i>0$ and the output is $h_0\|h_1\|\ldots$ - I'm not claiming this is collision-free.
So;
- Why XOFs are better than Hash Function in modeling Random oracles.