1=pod
2
3=head1 NAME
4
5EVP_MD-SHAKE, EVP_MD-KECCAK-KMAC
6- The SHAKE / KECCAK family EVP_MD implementations
7
8=head1 DESCRIPTION
9
10Support for computing SHAKE or KECCAK-KMAC digests through the
11B<EVP_MD> API.
12
13KECCAK-KMAC is an Extendable Output Function (XOF), with a definition
14similar to SHAKE, used by the KMAC EVP_MAC implementation (see
15L<EVP_MAC-KMAC(7)>).
16
17=head2 Identities
18
19This implementation is available in the FIPS provider as well as the default
20provider, and includes the following varieties:
21
22=over 4
23
24=item KECCAK-KMAC-128
25
26Known names are "KECCAK-KMAC-128" and "KECCAK-KMAC128".  This is used
27by L<EVP_MAC-KMAC128(7)>.  Using the notation from NIST FIPS 202
28(Section 6.2), we have S<KECCAK-KMAC-128(M, d)> = S<KECCAK[256](M || 00, d)>
29(see the description of KMAC128 in Appendix A of NIST SP 800-185).
30
31=item KECCAK-KMAC-256
32
33Known names are "KECCAK-KMAC-256" and "KECCAK-KMAC256".  This is used
34by L<EVP_MAC-KMAC256(7)>.  Using the notation from NIST FIPS 202
35(Section 6.2), we have S<KECCAK-KMAC-256(M, d)> = S<KECCAK[512](M || 00, d)>
36(see the description of KMAC256 in Appendix A of NIST SP 800-185).
37
38=item SHAKE-128
39
40Known names are "SHAKE-128" and "SHAKE128".
41
42=item SHAKE-256
43
44Known names are "SHAKE-256" and "SHAKE256".
45
46=back
47
48=head2 Gettable Parameters
49
50This implementation supports the common gettable parameters described
51in L<EVP_MD-common(7)>.
52
53=head2 Settable Context Parameters
54
55These implementations support the following L<OSSL_PARAM(3)> entries,
56settable for an B<EVP_MD_CTX> with L<EVP_MD_CTX_set_params(3)>:
57
58=over 4
59
60=item "xoflen" (B<OSSL_DIGEST_PARAM_XOFLEN>) <unsigned integer>
61
62Sets the digest length for extendable output functions.
63The length of the "xoflen" parameter should not exceed that of a B<size_t>.
64
65For backwards compatibility reasons the default xoflen length for SHAKE-128 is
6616 (bytes) which results in a security strength of only 64 bits. To ensure the
67maximum security strength of 128 bits, the xoflen should be set to at least 32.
68
69For backwards compatibility reasons the default xoflen length for SHAKE-256 is
7032 (bytes) which results in a security strength of only 128 bits. To ensure the
71maximum security strength of 256 bits, the xoflen should be set to at least 64.
72
73=back
74
75=head1 SEE ALSO
76
77L<EVP_MD_CTX_set_params(3)>, L<provider-digest(7)>, L<OSSL_PROVIDER-default(7)>
78
79=head1 COPYRIGHT
80
81Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
82
83Licensed under the Apache License 2.0 (the "License").  You may not use
84this file except in compliance with the License.  You can obtain a copy
85in the file LICENSE in the source distribution or at
86L<https://www.openssl.org/source/license.html>.
87
88=cut
89