Re: [PATCH v3 7/8] crypto/sha3: Add SHAKE128/256 support

[Eric Biggers]

On Fri, Sep 26, 2025 at 03:19:50PM +0100, David Howells wrote:
> SHAKE128/256 'digest' algos need to be available for the ML-DSA pre-digest,
> which is a selectable algorithm and need to be available through the same
> API as, say, SHA3-512 and SHA512 both.  Resqueezability (probably) isn't
> required for this and they'll produce the default number of bytes as the
> digest size.
> 
> Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
> cc: Eric Biggers <ebiggers@xxxxxxxxxx>
> cc: Jason A. Donenfeld <Jason@xxxxxxxxx>
> cc: Ard Biesheuvel <ardb@xxxxxxxxxx>
> cc: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
> cc: Stephan Mueller <smueller@xxxxxxxxxx>
> cc: linux-crypto@xxxxxxxxxxxxxxx
> ---
>  crypto/sha3_generic.c | 26 ++++++++++++++++++++++++++
>  1 file changed, 26 insertions(+)

I recommend holding off on this part until you have a try at using the
SHAKE library API directly.  The dispatch to different algorithms could
be done in the calling code.  This patch would also limit the ML-DSA
code to fixed-size SHAKE outputs; is that really going to be enough?

- Eric