1=pod 2 3=head1 NAME 4 5EVP_MD-SHAKE, EVP_MD-KECCAK-KMAC 6- The SHAKE / KECCAK family EVP_MD implementations 7 8=head1 DESCRIPTION 9 10Support for computing SHAKE or KECCAK-KMAC digests through the 11B<EVP_MD> API. 12 13KECCAK-KMAC is an Extendable Output Function (XOF), with a definition 14similar to SHAKE, used by the KMAC EVP_MAC implementation (see 15L<EVP_MAC-KMAC(7)>). 16 17=head2 Identities 18 19This implementation is available in the FIPS provider as well as the default 20provider, and includes the following varieties: 21 22=over 4 23 24=item KECCAK-KMAC-128 25 26Known names are "KECCAK-KMAC-128" and "KECCAK-KMAC128". This is used 27by L<EVP_MAC-KMAC128(7)>. Using the notation from NIST FIPS 202 28(Section 6.2), we have S<KECCAK-KMAC-128(M, d)> = S<KECCAK[256](M || 00, d)> 29(see the description of KMAC128 in Appendix A of NIST SP 800-185). 30 31=item KECCAK-KMAC-256 32 33Known names are "KECCAK-KMAC-256" and "KECCAK-KMAC256". This is used 34by L<EVP_MAC-KMAC256(7)>. Using the notation from NIST FIPS 202 35(Section 6.2), we have S<KECCAK-KMAC-256(M, d)> = S<KECCAK[512](M || 00, d)> 36(see the description of KMAC256 in Appendix A of NIST SP 800-185). 37 38=item SHAKE-128 39 40Known names are "SHAKE-128" and "SHAKE128". 41 42=item SHAKE-256 43 44Known names are "SHAKE-256" and "SHAKE256". 45 46=back 47 48=head2 Gettable Parameters 49 50This implementation supports the common gettable parameters described 51in L<EVP_MD-common(7)>. 52 53=head2 Settable Context Parameters 54 55These implementations support the following L<OSSL_PARAM(3)> entries, 56settable for an B<EVP_MD_CTX> with L<EVP_MD_CTX_set_params(3)>: 57 58=over 4 59 60=item "xoflen" (B<OSSL_DIGEST_PARAM_XOFLEN>) <unsigned integer> 61 62Sets the digest length for extendable output functions. 63The length of the "xoflen" parameter should not exceed that of a B<size_t>. 64 65The SHAKE-128 and SHAKE-256 implementations do not have any default digest 66length. 67 68This parameter must be set before calling either EVP_DigestFinal_ex() or 69EVP_DigestFinal(), since these functions were not designed to handle variable 70length output. It is recommended to either use EVP_DigestSqueeze() or 71EVP_DigestFinalXOF() instead. 72 73=back 74 75=head1 NOTES 76 77For SHAKE-128, to ensure the maximum security strength of 128 bits, the output 78length passed to EVP_DigestFinalXOF() should be at least 32. 79 80For SHAKE-256, to ensure the maximum security strength of 256 bits, the output 81length passed to EVP_DigestFinalXOF() should be at least 64. 82 83=head1 SEE ALSO 84 85L<EVP_MD_CTX_set_params(3)>, L<provider-digest(7)>, L<OSSL_PROVIDER-default(7)> 86 87=head1 HISTORY 88 89Since OpenSSL 3.4 the SHAKE-128 and SHAKE-256 implementations have no default 90digest length. 91 92=head1 COPYRIGHT 93 94Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved. 95 96Licensed under the Apache License 2.0 (the "License"). You may not use 97this file except in compliance with the License. You can obtain a copy 98in the file LICENSE in the source distribution or at 99L<https://www.openssl.org/source/license.html>. 100 101=cut 102
