[mykhal]

XOF, nice.. but what is the point of expanding SHAKE256 to e.g. 4096 bits, if its security remains 256 bits ?

[amluto]

To derive 4096 bits of pseudorandom data from an input. For example, you could derive 16 256-bit keys from one master secret.