liveBook · Manning

Extendable output function

As explained in Real-World Cryptography

An extendable output function is a cryptographic function that maps an input to an output of a caller-selected length.

An extendable output function maps an arbitrary-length input to a caller-selected output length. Unlike a fixed-digest hash, it can produce exactly as many output bytes as a protocol needs. section 2.5.3

Two standardized choices cover the main use cases:

  • SHAKE works like SHA-3 but continues its squeezing phase to produce outputs of arbitrary length, supporting digests, random numbers, and key derivation. section 2.5.3
  • cSHAKE adds a customization string, producing distinct deterministic outputs for different contexts and enabling domain separation. section 2.5.3

Customize the same input

cSHAKE("hello world", 256, "my_hash") and cSHAKE("hello world", 256, "your_hash") produce different digests because their customization strings differ.

How Real-World Cryptography covers it

How deep it goes
Defines SHAKE and cSHAKE, explains squeezing and customization, and stops short of detailed construction internals.
Examples
Uses cSHAKE calls with different customization strings to demonstrate distinct outputs from identical inputs.
What you can do after
Apply it via SHAKE or cSHAKE when fixed hash-digest sizes do not fit a cryptographic protocol.
How it connects
Connects SHA-3, SHAKE, cSHAKE, key derivation, random numbers, and domain separation.

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.