1=pod 2 3=head1 NAME 4 5EVP_MD-SHAKE, EVP_MD-KECCAK-KMAC 6- The SHAKE / KECCAK family EVP_MD implementations 7 8=head1 DESCRIPTION 9 10Support for computing SHAKE or KECCAK-KMAC digests through the 11B<EVP_MD> API. 12 13KECCAK-KMAC is an Extendable Output Function (XOF), with a definition 14similar to SHAKE, used by the KMAC EVP_MAC implementation (see 15L<EVP_MAC-KMAC(7)>). 16 17=head2 Identities 18 19This implementation is available in the FIPS provider as well as the default 20provider, and includes the following varieties: 21 22=over 4 23 24=item KECCAK-KMAC-128 25 26Known names are "KECCAK-KMAC-128" and "KECCAK-KMAC128". This is used 27by L<EVP_MAC-KMAC128(7)>. Using the notation from NIST FIPS 202 28(Section 6.2), we have S<KECCAK-KMAC-128(M, d)> = S<KECCAK[256](M || 00, d)> 29(see the description of KMAC128 in Appendix A of NIST SP 800-185). 30 31=item KECCAK-KMAC-256 32 33Known names are "KECCAK-KMAC-256" and "KECCAK-KMAC256". This is used 34by L<EVP_MAC-KMAC256(7)>. Using the notation from NIST FIPS 202 35(Section 6.2), we have S<KECCAK-KMAC-256(M, d)> = S<KECCAK[512](M || 00, d)> 36(see the description of KMAC256 in Appendix A of NIST SP 800-185). 37 38=item SHAKE-128 39 40Known names are "SHAKE-128" and "SHAKE128". 41 42=item SHAKE-256 43 44Known names are "SHAKE-256" and "SHAKE256". 45 46=back 47 48=head2 Gettable Parameters 49 50This implementation supports the common gettable parameters described 51in L<EVP_MD-common(7)>. 52 53=head2 Settable Context Parameters 54 55These implementations support the following L<OSSL_PARAM(3)> entries, 56settable for an B<EVP_MD_CTX> with L<EVP_MD_CTX_set_params(3)>: 57 58=over 4 59 60=item "xoflen" (B<OSSL_DIGEST_PARAM_XOFLEN>) <unsigned integer> 61 62Sets the digest length for extendable output functions. 63The length of the "xoflen" parameter should not exceed that of a B<size_t>. 64 65For backwards compatibility reasons the default xoflen length for SHAKE-128 is 6616 (bytes) which results in a security strength of only 64 bits. To ensure the 67maximum security strength of 128 bits, the xoflen should be set to at least 32. 68 69For backwards compatibility reasons the default xoflen length for SHAKE-256 is 7032 (bytes) which results in a security strength of only 128 bits. To ensure the 71maximum security strength of 256 bits, the xoflen should be set to at least 64. 72 73=back 74 75=head1 SEE ALSO 76 77L<EVP_MD_CTX_set_params(3)>, L<provider-digest(7)>, L<OSSL_PROVIDER-default(7)> 78 79=head1 COPYRIGHT 80 81Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved. 82 83Licensed under the Apache License 2.0 (the "License"). You may not use 84this file except in compliance with the License. You can obtain a copy 85in the file LICENSE in the source distribution or at 86L<https://www.openssl.org/source/license.html>. 87 88=cut 89