Questions tagged [xof]

An extendable-output function (XOF) is similar to a hash function, but uses the internal state to output a stream of bits instead of a fixed-length octet string.

Filter by
Sorted by
Tagged with
1
vote
0answers
29 views

Exact security requirements for extendable output functions (XOF)?

In the FIPS202 document "SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions" an extendable-output functions is defined as: An extendable-output function (XOF) is a ...
0
votes
0answers
28 views

How do I use XOF (SHAKE and cSHAKE) in openssl CLI and JavaScript

I am learning about hash functions and I just read about XOF (namely shake and cShake). I will like to test this functions out by myself but I can't seem to find how to use it via the OpenSSL CLI or ...
2
votes
1answer
138 views

Number of rounds for constant header size in common hashes and XOFs

We compute hash $H(M_0\mathbin\|M_1)$ of size $d\ge1$ for some constant header $M_0$ of size $m_0$, and $\nu\ge1$ messages $M_1$ of random content and size $m_1$. For Merkle-Damgård hashes, a simple ...
2
votes
1answer
227 views

Why XOFs are more convenient than Hash Functions in modeling Random Oracles

In this answer, it is mentioned that Easier instantiation of random oracles. Some security proofs rely on the so-called random oracle model to prove the security of a given scheme. Normally you'd ...
2
votes
0answers
60 views

Is it possible to use a XOF function as csrng? [duplicate]

Let's say we "seed" a xof function (eg. SHAKE256) with x cryptographically random bytes (enough so that they can't be bruteforced), could said function be used as a cryptographically secure random ...
2
votes
3answers
303 views

Are XOFs and KDFs more usable than DRBGs?

CSPRNGs have 2 design requirements: output unpredictability, back-tracing resistance. In addition to which, NIST SP 800-90Ar1 added other features such as a) instance customization/personalization,...
2
votes
1answer
255 views

Can any hash function based on the sponge construction work as extendable output function?

Keccak provides a sort of very useful XOFs. Can other sponge construction hash function like Spongent work as XOF? Is there any lightweight XOF for hardware or software implementation?
9
votes
2answers
535 views

Functional difference between stream cipher, XOF, seed expander, KDF, etc

This question is a request for terminology clarification. In a canonical XOF interface, the output can be extended as much as needed, but does input has to be variable-length or can be fixed-length ...
7
votes
1answer
1k views

What is an extendable output function?

The standardization of SHA-3 included the specification of two functions, SHAKE128 and SHAKE256. Both SHAKEs are referred to as extendable output functions, but what makes a function an extendable ...
0
votes
1answer
172 views

RSA-KEM: minimal number of random bits

I've already asked a few - as yet officially unanswered - questions about RSA-KEM with regards to the input secret encrypted using the public key here and (less on topic for this question) here. ...
2
votes
0answers
173 views

Using NIST constructions based on Keccak like cSHAKE128 for other sponges

NIST defines a lot of interesting applications of sponges in FIPS 202 and NIST SP 800-185 like the XOF cSHAKE128 or the MAC scheme KMAC. All this schemes come with a security guarantee and are ...
6
votes
2answers
287 views

FIPS 202/SHAKE: insecure 3DES key derivation example

I'm trying to understand the following passage from FIPS 202 (the SHA-3 standard), discussing the SHAKE functions' correlated outputs for different output lengths and the risks they induce in some ...
7
votes
2answers
371 views

Will a SHAKE128 stream cipher be vulnerable to related key attacks?

Suppose that SHAKE is seeded with key concatenated to an IV, will the 'key' stream produced by SHAKE128 vulnerable to related key attacks like RC4 is? My guess is no because seed is already "...
4
votes
1answer
749 views

Can MGF1 within OAEP and PSS be replaced by a XOF?

Do we still need MGF1 as used in the PKCS#1 v2.x specifications for SHA-3 hash functions? MGF1 is currently used for OAEP and PSS as Mask Generation Function. Now that the SHA-3 specification contains ...
15
votes
2answers
5k views

Use case for extendable-output functions (XOF) such as SHAKE128/SHAKE256

FIPS 202 defines 2 functions, SHAKE128 and SHAKE256, as extendable-output functions (XOFs) that can have variable output length. But in Appendix A.2 marks: it is possible to use an XOF as a hash ...