An extendable output function maps an arbitrary-length input to a caller-selected output length. Unlike a fixed-digest hash, it can produce exactly as many output bytes as a protocol needs. section 2.5.3
Two standardized choices cover the main use cases:
- SHAKE works like SHA-3 but continues its squeezing phase to produce outputs of arbitrary length, supporting digests, random numbers, and key derivation. section 2.5.3
- cSHAKE adds a customization string, producing distinct deterministic outputs for different contexts and enabling domain separation. section 2.5.3
Customize the same input
cSHAKE("hello world", 256, "my_hash") and cSHAKE("hello world", 256, "your_hash") produce different digests because their customization strings differ.
