In the tradition started by Colin Percival and Thomas Ptacek, a set of “Cryptographic Right Answers” updated for the accelerated post-quantum transition timeline.
If you already have Keccak (SHA-3) around for ML-KEM and ML-DSA, and you want to use it for hashing, draw 32 bytes from SHAKE128.
@FiloSottile Is this because SHAKE supports arbitrary length?
(As a non cryptographer…) Are the preimage discussions around SHAKE not relevant in the “Hash Function” context?
@FiloSottile Is this because SHAKE supports arbitrary length?
(As a non cryptographer…) Are the preimage discussions around SHAKE not relevant in the “Hash Function” context?
score 1 · canonical