TupleHash
Hash a list of strings unambiguously — ["ab","c"] and ["a","bc"] give different digests, unlike any plain hash of the concatenation.
Input — 2
TupleHash128
f8c5296b7c295eac175621ece2fe037436b6f8e9486730b251162f6880affab5
Output of any length
An ordinary hash gives you a fixed number of bytes. An extendable-output function lets you ask for however many you need, and a longer request is simply a longer prefix of the same stream — asking for 64 bytes gives you the 32-byte answer followed by 32 more.
That makes it a natural key-derivation and mask-generation primitive: post-quantum schemes such as ML-KEM use SHAKE to expand a seed into as much material as the algorithm needs.
- SHAKE128 / SHAKE256 — the number is the security level, not the output size.
- cSHAKE — the same, plus a customization string so two uses in one system never produce the same stream.
- KMAC — keyed, and the SHA-3 era answer to HMAC.
- TupleHash — hashes a list of strings unambiguously, so ["ab","c"] and ["a","bc"] differ.
Frequently asked questions
Does SHAKE256 produce 256 bits?
Not necessarily — you choose the length. The 256 is the security level. SHAKE128 can output 64 bytes too; it just offers 128-bit security while doing so.
Why does a longer output share a prefix with a shorter one?
Because squeezing is a stream. That is the defining property of an XOF, and it means you must not treat two different-length outputs of the same input as independent values.