Can MGF1 within OAEP and PSS be replaced by a XOF? Do we still need MGF1 as used in the PKCS#1 v2.x specifications for SHA-3 hash functions? MGF1 is currently used for OAEP and PSS as Mask Generation Function. Now that the SHA-3 specification contains SHAKE128 and SHAKE256 could MGF1 be replaced?

It seems to me that there is only one input to MGF1, called the seed. It seems that MGF1 is directly replaceable with a XOF which also has one input and one output. In that case we could call MGF2 = XOF, and the XOF (hash) function would simply be one of the SHAKE functions specified in the SHA-3 standard.

Will a extendable-output function directly cover the security requirements expected from a mask generation function?
It seems that the authors of Keccak sponge (the algorithm chosen to be SHA-3) do think their SHAKE functions can directly be used for simplifying OAEP and PSS:


  The introduction of extendable-output functions (or XOFs, pronounced zoff) is a particularly nice feature of the standard. A XOF like SHAKE128 or SHAKE256 can be seen as a generalization of hash functions where the output length is not fixed but is potentially infinite. Concretely, XOFs can be used instead of complex constructions involving hash functions and counters such as MGF1. With RSA, this is of immediate benefit to full domain hashing (edit: also known as FDH), to RSA OAEP (Optimal Asymmetric Encryption Padding) and to RSA PSS (Probabilistic Signature Scheme). Other use cases are key derivation functions and stream ciphers.