OK so NIST-SHAKE512-[0 <= bit < 256] is basically what was proposed as round 3 Keccak-256. But it's a) unwieldy to specify, and b) reveals the output of NIST-S

OK so NIST-SHAKE512-[0 <= bit < 256] is basically what was proposed as round 3 Keccak-256. But it's a) unwieldy to specify, and b) reveals the output of NIST-SHAKE512-[0 <= bit < 128] unlike other truncated hash standards. Note: I am definitely not saying this is the end of the world.