SHAKE256

SHAKE256 is a member of the SHA-3 family of cryptographic hash functions and extendable-output functions (XOFs). It is based on the Keccak sponge function and standardized by the National Institute of Standards and Technology in FIPS 202. As an XOF, SHAKE256 can produce an output of arbitrary length, making it suitable for a range of applications that require flexible output size.

Operation and parameters: The construction uses a 1600-bit state and a sponge with a capacity of 512 bits, which provides a security level up to 256 bits. The corresponding rate is 1088 bits (136 bytes) per absorption/squeeze block. Data is absorbed into the state, the Keccak-f[1600] permutation is applied, and output bits are squeezed from the state. The padding rule employed is multi-rate padding (pad10*1). Because of its extendable output, the same instance can be squeezed to produce as many bits as needed.

Output length and usage: SHAKE256 outputs any desired length of data, which enables its use as a general-purpose hash, function PRF, or key-derivation tool when proper domain separation is applied. It is important to apply domain separation and avoid reusing the same XOF instance for different purposes without clear separation.

Standardization and relation to fixed-length variants: SHAKE256 is defined in FIPS 202 as part of the SHA-3 family, alongside fixed-length variants such as SHA3-256. The core Keccak sponge and padding are shared across the family, with the main differences being the chosen capacity and the fixed versus extendable output length. SHAKE256 thus provides flexible output while offering a security level tied to its 512-bit capacity.