Unlike a hash with a fixed digest, an XOF is asked for d bits of output; its collision resistance is min(d/2, capacity/2) and preimage resistance min(d, capacity/2). SHAKE128 has a 256-bit capacity and SHAKE256 a 512-bit one. Asking SHAKE256 for 32 or 64 bytes yields prefixes of the same stream, so callers must domain-separate different uses; cSHAKE (SP 800-185) adds explicit customization strings.
SHAKE is everywhere in post-quantum cryptography: ML-KEM and ML-DSA expand their public matrices with SHAKE128 and derive other values with SHAKE256 (FIPS 203 and FIPS 204 call them XOF, H, J and G), SLH-DSA has SHAKE parameter sets, and Ed448 hashes with SHAKE256. FIPS 186-5 also allows SHAKE as the hash and mask function in RSASSA-PSS.
Identifiers: OIDs 2.16.840.1.101.3.4.2.11 (SHAKE128) and …2.12 (SHAKE256); OpenSSL shake128 and shake256 with -xoflen; Python's hashlib.shake_256(data).digest(n).