Keccak is the winner of the SHA3 competition. Since Keccak is highly customizable (presumably for security/memory/time/speed tradeoffs) there does seem to be some controversy around how Keccak compares to SHA2. SHAKE appears to be a set of parameters to reduce friction in the drop-in replacement of SHA2
How does Keccak/SHAKE compare to SHA2 in terms of :
- bits of security
- bit pre-image resistance
- second pre-image resistance
- the statement "security strength levels above 256 bits is meaningless."
- "SHA-3 is less appropriate for use as a PRF for pbkdf2 than SHA-2"
- Any other criteria worthy of comparison
Given that this is a very complex topic, and Keccak having many permutations, I think it's possible the SHAKE simplification may have removed some flexibility, security, and performance from certain scenarios...
That being said, what scenarios are worth diverging from the SHAKE standard and using Keccak directly (for lack of a better analogy)?