YoSin Tools

cSHAKE128 Hash Generator

Generate cSHAKE128 (Customizable SHAKE128) hashes online. NIST SP 800-185 standard. Set function name (N), customization string (S), and output length. When N and S are empty, behaves as SHAKE128.

Input
Output
Share Link
Settings
Hash

Related Hash Tools

cSHAKE128 FileHash from file cSHAKE256256-bit security cSHAKE SHAKE128Basic SHAKE128 XOF KMAC128Keyed MAC from cSHAKE128 SHA3-256Fixed SHA3-256

Frequently Asked Questions

What is cSHAKE128?
cSHAKE128 is a customizable variant of SHAKE128 from NIST SP 800-185. It takes two extra parameters: N (function name) and S (customization string). These enable domain separation, so the same function produces different outputs for different application contexts.
When should I use the customization string (S)?
Use S to separate different uses of cSHAKE128 within a protocol. For example, set S='key_derivation' in one context and S='message_authentication' in another to ensure the two invocations produce independent outputs even for the same input.
What should I set for the function name (N)?
N is reserved for NIST-approved derived functions (e.g., KMAC sets N='KMAC'). For your own applications, leave N empty and only use S for customization.
cSHAKE128 vs KMAC128?
KMAC128 is built on cSHAKE128 and is designed specifically for keyed hashing (MAC). It uses N='KMAC' and encodes the key length. If you need a keyed hash, use KMAC128. For unkeyed customized hashing, use cSHAKE128 directly.

About cSHAKE128 Hash Generator

cSHAKE128 (Customizable SHAKE-128) is an extendable output function standardized in NIST SP 800-185 (2017). It extends SHAKE128 with two additional inputs: a function name N and a customization string S. These inputs are encoded into the initial padding of the sponge function, creating domain separation between different invocations of the same underlying algorithm.

Domain Separation

The primary purpose of cSHAKE128 over plain SHAKE128 is domain separation. When a protocol uses a hash function for multiple purposes (key derivation, authentication, encryption key generation), using the same hash function without domain separation can lead to related outputs that weaken security. cSHAKE128 prevents this by incorporating N and S into the sponge initialization, ensuring that cSHAKE128(msg, L, "signing", "") and cSHAKE128(msg, L, "encryption", "") produce cryptographically independent outputs.

Relationship to SHAKE128

When both N and S are empty strings, cSHAKE128 is identical to SHAKE128. The customization is only applied when at least one is non-empty. This backward compatibility ensures that systems can transition to cSHAKE128 while maintaining compatibility with SHAKE128 for default use cases.

KMAC128 and Other SP 800-185 Functions

KMAC128 (Keccak Message Authentication Code) is built directly on cSHAKE128 by setting N='KMAC' and encoding the key and its length. ParallelHash and TupleHash are also defined in SP 800-185 using cSHAKE as a building block.