Date Published: October 8, 2026
Comments Due:
Email Comments to:
Author(s)
John Kelsey (NIST), Ray Perlner (NIST), Meltem Sönmez Turan (NIST)
Announcement
Revision 1 introduces streaming interfaces for extendable-output function (XOF) computations, which allow applications to process input and request output incrementally without knowing the total input or output length in advance.
From the Note to Reviewers (p. v):
- The Keccak-derived functions in this recommendation have been updated to describe a
streaming mode of access that provides full XOF functionality. This involves calls to three
functions: INIT, ABSORB, and SQUEEZE.
- Illustrative pseudocode is provided for the streaming interface, but the correct behavior of
all streaming modes is defined in terms of the corresponding single-call interface to the
functions.
- The single-call interfaces for these functions are equivalent to the functions defined in the
previous version of this document.
- cSHAKE, KMAC, and ParallelHash use the ABSORB function to incrementally input
data into the function so that ABSORB(𝑋1) followed by ABSORB(𝑋2) has the same effect
as ABSORB(𝑋1 ∥ 𝑋2).
- TupleHash uses the absorb function somewhat differently in that each ABSORB call
processes one complete tuple element. NIST invites comment on whether this different use
of ABSORB might be confusing.
The public comment period is open through December 7, 2026.
NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
This recommendation specifies four types of SHA-3-derived functions: cSHAKE, KMAC, TupleHash, and ParallelHash, each defined for 128-and 256-bit security strengths. cSHAKE is a customizable variant of the SHAKE function, as defined in Federal Information Processing Standards publication (FIPS) 202. KMAC (Keccak Message Authentication Code) is a variable-length message authentication code algorithm based on Keccak (specified in FIPS 202) that can also be used as a pseudorandom function. TupleHash is a variable-length hash function designed to hash tuples of input strings without trivial collisions. ParallelHash is a variable-length hash function that can hash very long messages in parallel. This revision adds a streaming mode for XOF computations, which allows applications to process input and request output incrementally when the total input or output length is not known in advance.
This recommendation specifies four types of SHA-3-derived functions: cSHAKE, KMAC, TupleHash, and ParallelHash, each defined for 128-and 256-bit security strengths. cSHAKE is a customizable variant of the SHAKE function, as defined in Federal Information Processing Standards publication (FIPS) 202....
See full abstract
This recommendation specifies four types of SHA-3-derived functions: cSHAKE, KMAC, TupleHash, and ParallelHash, each defined for 128-and 256-bit security strengths. cSHAKE is a customizable variant of the SHAKE function, as defined in Federal Information Processing Standards publication (FIPS) 202. KMAC (Keccak Message Authentication Code) is a variable-length message authentication code algorithm based on Keccak (specified in FIPS 202) that can also be used as a pseudorandom function. TupleHash is a variable-length hash function designed to hash tuples of input strings without trivial collisions. ParallelHash is a variable-length hash function that can hash very long messages in parallel. This revision adds a streaming mode for XOF computations, which allows applications to process input and request output incrementally when the total input or output length is not known in advance.
Hide full abstract
Keywords
cryptography; cSHAKE; customizable SHAKE function; hash function; information security; integrity; Keccak; KMAC; message authentication code; parallel hashing; ParallelHash; PRF; pseudorandom function; SHA-3; SHAKE; tuple hashing; TupleHash; authentication
Control Families
None selected
