Extendableoutput

Extendableoutput refers to the cryptographic concept of an extendable-output function, or XOF, a function whose output length can be chosen by the caller. An XOF takes a message and produces a stream of bytes of arbitrary length, while maintaining security properties similar to fixed-length hash functions over the portion of output that is requested.

XOFs are typically built from sponge constructions, such as the Keccak family. In a sponge-based XOF, input data is absorbed into an internal state, and output is produced by repeatedly squeezing the state to yield bytes. To obtain more output, squeezing continues, and domain separation constants or other techniques are often used to prevent cross-output interference between different uses or different lengths. The flexibility to produce any desired number of output bits is what distinguishes XOFs from conventional hash functions.

Common examples include SHAKE-128 and SHAKE-256, which are part of the SHA-3 family, as well as variants like cSHAKE and KMAC, which introduce customization and message authentication features. XOFs are used in applications such as pseudorandom number generation, streaming key derivation, digital signatures, and protocols that require long or variable-length outputs. They enable efficient generation of large pseudorandom streams from a fixed input while maintaining security guarantees suitable for modern cryptographic protocols.

Security and usage considerations include relying on well-vetted sponge constructions, applying proper domain separation, and ensuring the chosen output length aligns with security objectives. Care is taken to prevent reuse of internal state and to integrate XOFs into systems with appropriate parameter choices and validations.