What are the uses of arbitrary length output hashes (other than OAEP)? Functions such as SHA-3 from the Keccak family allow for a hash of arbitrary length output. These functions are (according to Wikipedia) useful for practical, lightweight applications.

I know that SHAKE-128 and SHAKE-256 can be applied for OAEP.

My question is: Are there currently any other applications found for such functions?
Uses for SHAKE/XOF functions
Community wiki answer, please add and edit:

key derivation of any type

such as turning a 128-256 bit secret key into an ECC or RSA public/private key pair


deterministic secure uniform random number generation starting from a small seed

this might be used in fuzzing tools, simulations, etc. where you want a lot of random data for your experiment but you want it to be repeatable


stream ciphers

absorb the key and IV then output the key stream


authenticated encryption

such as the duplex construction


length-preserving data obfuscation or anonymization

One might hash all customer data from a production environment when being copied into a development environment. An XOF can presereve the data cardinality distribution as well as the data size distribution of the &quot;real&quot; production data for accurate testing and performance comparisons in non-production environments.


digital signatures

digital signatures such as EdDSA employ hash functions whose output must be a specific size, some of them &quot;awkward&quot; (e.g. Ed448 requires a 912-bit hash function). This can be easily accomplished with a XOF. (In fact, Ed448 uses SHAKE256.)