Selecting hash functions. SHAKE256, part of the forthcoming SHA-3 hash-function standard, is
designed to straightforwardly generate arbitrary output lengths at a 2256 security level. (Efficiency
note: SHAKE256 internally generates outputs as 136-byte blocks, so a single SHAKE256 block
handles b as large as 544.) Choosing SHAKE256 with 2b-bit output as the hash function inside
EdDSA has the benefit of allowing multiple curve sizes to be handled directly by a single hashing
module. SHA-3 has many other advantages over SHA-2, not summarized here.