diff --git a/alpha_0.1.3_release_notes.md b/alpha_0.1.3_release_notes.md
index 210a5aeb..eec8d564 100644
--- a/alpha_0.1.3_release_notes.md
+++ b/alpha_0.1.3_release_notes.md
@@ -3,3 +3,36 @@
 ## Major features
 
 ## Minor features / bug fixes
+
+Bit-oriented messages:
+
+* `Hash::do_final_partial_bits()` / `do_final_partial_bits_out()` accept `num_partial_bits` in 0..=7 (0 meaning the
+  message ends on a byte boundary); larger values return `HashError::InvalidLength` instead of panicking. The convention
+  is the same for every hash family: the trailing bits are in the least significant bits of `partial_byte` (FIPS 202
+  Appendix B.1) -- see the `Hash` trait docs, including the note on the MSB-first packing used by the NIST CAVP SHA-2
+  vector files.
+
+SHA-3 / SHAKE (PR #87):
+
+* Fixed `XOF::squeeze_partial_byte_final()`: when it was the first squeeze it bypassed the SHAKE `1111` domain suffix
+  and returned raw Keccak output, and it returned the *high* rather than the low `num_bits` bits of the output byte.
+  The existing test used `0xFF`, which masked the second error.
+* Fixed `XOF::absorb_last_partial_byte()` for `num_partial_bits == 4`: the 4 message bits plus the `1111` suffix
+  exactly filled a byte and the sponge did not switch to squeezing, so the first squeeze appended the suffix a second
+  time. Every SHAKE message with a bit length of 4 mod 8 was affected. Found by the new CAVP harness.
+* `absorb_last_partial_byte()` and `do_final_partial_bits*()` now validate `num_partial_bits` before use; previously
+  SHA-3 accepted 8..15 and absorbed garbage, panicked for >= 16, and SHAKE rejected 0 with an error message claiming
+  `[0,7]`.
+* Interleaving absorb -> squeeze -> absorb remains rejected with `HashError::InvalidState`; the `XOF` trait docs now
+  explain why (it is the duplex construction, not SHAKE).
+* `HashAlgParams` for the SHA-3 types is now forwarded from the `*Params` structs, so `OUTPUT_LEN` / `BLOCK_LEN` are
+  defined once. Removed misleading leftover SHA-2 block-size comments.
+* Crate docs gained "Memory Usage" and "Security Considerations" sections.
+
+Testing:
+
+* SHA-3 / SHAKE now run the NIST CAVP SHA3VS vector sets from bc-test-data (`crypto/sha3`: ShortMsg, LongMsg, Monte
+  Carlo and SHAKE VariableOut; bit- and byte-oriented, ~13k cases) using the same `../bc-test-data` lookup convention as
+  the mldsa/mlkem crates; the tests skip with a warning if the repo is not checked out. The vendored FIPS 202 example
+  vectors in `crypto/sha3/tests/data` were removed in favour of the bc-test-data copies. Note that `cargo mutants` runs
+  in a copied tree where `../bc-test-data` does not resolve, so these tests do not contribute to mutation coverage.
diff --git a/crypto/core/src/traits.rs b/crypto/core/src/traits.rs
index 7e23d516..356ab65b 100644
--- a/crypto/core/src/traits.rs
+++ b/crypto/core/src/traits.rs
@@ -310,7 +310,15 @@ pub trait Hash: Algorithm + Default {
     fn do_final_out(self, output: &mut [u8]) -> usize;
 
     /// The same as [`Hash::do_final`], but allows for supplying a partial byte as the last input.
-    /// Assumes that the input is in the least significant bits (big endian).
+    /// The `num_partial_bits` message bits are taken from the least significant bits of
+    /// `partial_byte`, in order (bit 0 of `partial_byte` is the first message bit). This is the
+    /// FIPS 202 Appendix B.1 convention and is used uniformly for every hash family in this library,
+    /// including SHA-2, for which FIPS 180-4 defines no bit-to-byte packing. Note that the NIST CAVP
+    /// SHAVS (SHA-2) test vector files pack trailing bits MSB-first (left-justified) and must be
+    /// shifted right by `8 - num_partial_bits` before being passed here; the SHA3VS files already use
+    /// the LSB convention.
+    /// `num_partial_bits` must be in `0..=7`; 0 is valid and means the message ends on a byte
+    /// boundary (equivalent to [`Hash::do_final`]). Larger values return [`HashError::InvalidLength`].
     fn do_final_partial_bits(
         self,
         partial_byte: u8,
@@ -318,7 +326,15 @@ pub trait Hash: Algorithm + Default {
     ) -> Result<Vec<u8>, HashError>;
 
     /// The same as [`Hash::do_final_out`], but allows for supplying a partial byte as the last input.
-    /// Assumes that the input is in the least significant bits (big endian).
+    /// The `num_partial_bits` message bits are taken from the least significant bits of
+    /// `partial_byte`, in order (bit 0 of `partial_byte` is the first message bit). This is the
+    /// FIPS 202 Appendix B.1 convention and is used uniformly for every hash family in this library,
+    /// including SHA-2, for which FIPS 180-4 defines no bit-to-byte packing. Note that the NIST CAVP
+    /// SHAVS (SHA-2) test vector files pack trailing bits MSB-first (left-justified) and must be
+    /// shifted right by `8 - num_partial_bits` before being passed here; the SHA3VS files already use
+    /// the LSB convention.
+    /// `num_partial_bits` must be in `0..=7`; 0 is valid and means the message ends on a byte
+    /// boundary (equivalent to [`Hash::do_final_out`]). Larger values return [`HashError::InvalidLength`].
     /// will be placed in the first [`Hash::output_len`] bytes.
     /// The entire output buffer is zeroized before the hash output is written.
     /// The return value is the number of bytes written.
@@ -1057,6 +1073,14 @@ pub trait SignatureVerifier<
 /// to break anonymity-preserving technology.
 /// Applications that require the arbitrary-length output of an XOF, but also care about these
 /// distinguishing attacks should consider adding a cryptographic salt to diversify the inputs.
+///
+/// # Absorbing after squeezing
+/// Once squeezing has begun, further calls to [`XOF::absorb`] / [`XOF::absorb_last_partial_byte`]
+/// return [`HashError::InvalidState`] and leave the object usable for further squeezing. FIPS 202
+/// defines SHAKE as a function of a single, complete message; the sponge's absorb/squeeze phases are
+/// internal to computing it. Interleaving absorb → squeeze → absorb → squeeze is the *duplex*
+/// construction, which is a different (unapproved) primitive whose output is not the SHAKE of any
+/// message and is not reproducible by other SHAKE implementations, so it is deliberately rejected.
 pub trait XOF: Default {
     /// A static one-shot API that digests the input data and produces `result_len` bytes of output.
     fn hash_xof(self, data: &[u8], result_len: usize) -> Vec<u8>;
@@ -1069,7 +1093,9 @@ pub trait XOF: Default {
     /// Absorb some amount of input.
     fn absorb(&mut self, data: &[u8]) -> Result<(), HashError>;
 
-    /// Switches to squeezing.
+    /// Absorbs the final `num_partial_bits` (`0..=7`, least significant bits of `partial_byte`) of the
+    /// message and switches to squeezing. 0 is valid and means the message ends on a byte boundary.
+    /// Values above 7 return [`HashError::InvalidLength`].
     fn absorb_last_partial_byte(
         &mut self,
         partial_byte: u8,
@@ -1084,8 +1110,11 @@ pub trait XOF: Default {
     /// The entire output buffer is zeroized before the output is written.
     fn squeeze_out(&mut self, output: &mut [u8]) -> usize;
 
-    /// Squeezes a partial byte from the XOF.
-    /// Output will be in the top `num_bits` bits of the returned u8 (ie Big Endian).
+    /// Squeezes a partial byte (`num_bits` in `1..=7`) from the XOF.
+    /// The bits are returned in the least significant `num_bits` bits of the returned u8, with the
+    /// remaining high bits zero. This follows the FIPS 202 Appendix B.1 bit-string convention
+    /// (the first bit of a byte is its least significant bit) and matches the input convention of
+    /// [`XOF::absorb_last_partial_byte`].
     /// This is a final call and consumes self.
     fn squeeze_partial_byte_final(self, num_bits: usize) -> Result<u8, HashError>;
 
diff --git a/crypto/sha3/src/keccak.rs b/crypto/sha3/src/keccak.rs
index 10f85f44..a2da127f 100644
--- a/crypto/sha3/src/keccak.rs
+++ b/crypto/sha3/src/keccak.rs
@@ -250,12 +250,14 @@ impl KeccakInternal {
         }
     }
 
+    /// Absorbs the final `bits` (0..=7, in the least significant bits of `data`) of the message and
+    /// switches the sponge to the squeezing phase. `bits == 0` means "no further bits": the sponge is
+    /// padded and switched to squeezing without absorbing anything. Callers that have already applied a
+    /// domain-separation suffix rely on this — if the switch did not happen here, a later squeeze would
+    /// see `squeezing == false` and apply the suffix a second time.
     pub(super) fn absorb_bits(&mut self, data: u8, bits: usize) -> Result<(), HashError> {
-        if bits == 0 {
-            return Ok(());
-        }
-        if !(1..=7).contains(&bits) {
-            return Err(HashError::InvalidLength("bits must be in the range 1 to 7"));
+        if bits > 7 {
+            return Err(HashError::InvalidLength("bits must be in the range 0 to 7"));
         }
         if (self.bits_in_queue & 7) != 0 {
             return Err(HashError::InvalidState("attempt to absorb with odd length queue"));
@@ -264,11 +266,13 @@ impl KeccakInternal {
             return Err(HashError::InvalidState("attempt to absorb while squeezing"));
         }
 
-        let mask = (1 << bits) - 1;
-        self.data_queue[self.bits_in_queue >> 3] = data & mask;
+        if bits != 0 {
+            let mask = (1 << bits) - 1;
+            self.data_queue[self.bits_in_queue >> 3] = data & mask;
 
-        // NOTE: After this, bits_in_queue is no longer a multiple of 8, so no more absorbs will work
-        self.bits_in_queue += bits;
+            // NOTE: After this, bits_in_queue is no longer a multiple of 8, so no more absorbs will work
+            self.bits_in_queue += bits;
+        }
         self.pad_and_switch_to_squeezing_phase();
         Ok(())
     }
@@ -500,18 +504,57 @@ mod keccak_tests {
     use super::*;
     use bouncycastle_hex as hex;
 
+    /// Basic sponge sanity: absorbing in one chunk or many gives the same output, successive
+    /// squeezes continue the stream (do not repeat), and different capacities give different output.
     #[test]
     fn test_keccak() {
-        let mut d = KeccakInternal::new(KeccakSize::_256);
         let m_vec = hex::decode("6d657373616765").unwrap();
+
+        let mut d = KeccakInternal::new(KeccakSize::_256);
         d.absorb(&m_vec);
+        let mut out1 = [0u8; 32];
+        d.squeeze(&mut out1);
+        let mut out2 = [0u8; 32];
+        d.squeeze(&mut out2);
+        assert_ne!(out1, [0u8; 32]);
+        assert_ne!(out1, out2, "successive squeezes must continue the output stream");
+
+        // chunked absorb + single 64-byte squeeze must reproduce out1 || out2
+        let mut d = KeccakInternal::new(KeccakSize::_256);
+        for b in &m_vec {
+            d.absorb(core::slice::from_ref(b));
+        }
+        let mut out64 = [0u8; 64];
+        d.squeeze(&mut out64);
+        assert_eq!(&out64[..32], &out1);
+        assert_eq!(&out64[32..], &out2);
 
-        let mut out = [0u8; 32];
-        d.squeeze(&mut out);
-        println!("n1: {:x?}", &out);
+        let mut d = KeccakInternal::new(KeccakSize::_512);
+        d.absorb(&m_vec);
+        let mut out_c512 = [0u8; 32];
+        d.squeeze(&mut out_c512);
+        assert_ne!(out_c512, out1);
+    }
 
-        d.squeeze(&mut out);
-        println!("n2: {:x?}", &out);
+    /// absorb_bits(): 0..=7 bits are accepted and always switch the sponge to squeezing (0 bits
+    /// included — see the doc comment); 8+ bits are rejected; a second call is rejected as squeezing.
+    #[test]
+    fn absorb_bits_range_and_phase() {
+        for bits in 0..=7usize {
+            let mut d = KeccakInternal::new(KeccakSize::_256);
+            d.absorb(b"abc");
+            d.absorb_bits(0xFF, bits).unwrap();
+            assert!(d.squeezing, "bits={bits}: must switch to squeezing");
+            assert!(matches!(d.absorb_bits(0, 1), Err(HashError::InvalidState(_))));
+        }
+        for bits in [8usize, 9, 16, usize::MAX] {
+            let mut d = KeccakInternal::new(KeccakSize::_256);
+            assert!(
+                matches!(d.absorb_bits(0, bits), Err(HashError::InvalidLength(_))),
+                "bits={bits}"
+            );
+            assert!(!d.squeezing, "rejected call must not change phase");
+        }
     }
 
     /// Regression test for from_serialized_state's validation of a not-yet-squeezing queue: a corrupt
diff --git a/crypto/sha3/src/lib.rs b/crypto/sha3/src/lib.rs
index bc689b95..841451c0 100644
--- a/crypto/sha3/src/lib.rs
+++ b/crypto/sha3/src/lib.rs
@@ -89,7 +89,7 @@
 //! [`KDF`] acts on [`KeyMaterial`] objects as both the input and output values.
 //! In the case of SHA3, the [`KDF`] interfaces are simple wrapper functions around the underlying SHA3 or SHAKE
 //! primitive that correctly maintains the length and entropy metadata of the key material that it is acting on.
-//! This is intended to act as a developer ait to prevent  some classes of developer mistakes, such as
+//! This is intended to act as a developer aid to prevent some classes of developer mistakes, such as
 //! deriving a cryptographic key from uninitialized (aka zeroized) input key material, or using low-entropy
 //! input key material to derive a MAC, symmetric, or asymmetric key.
 //!
@@ -108,6 +108,31 @@
 //! [`KeyType::CryptographicRandom`] since the input [`KeyMaterial`] is 16 bytes but [`SHA3_256`] needs at least 32 bytes of
 //! full-entropy input key material in order to be able to produce full entropy output key material.
 //!
+//! # Memory Usage
+//!
+//! All SHA3 and SHAKE variants share the same Keccak-f\[1600\] sponge and so have identical memory
+//! footprints. No heap memory is used by the algorithms themselves; the `Vec<u8>`-returning
+//! convenience methods allocate only the output buffer, and the `*_out` variants allocate nothing.
+//!
+//! | Object                                  | Size (bytes) |
+//! |-----------------------------------------|--------------|
+//! | `SHA3_224` .. `SHA3_512`, `SHAKE128/256` | 440          |
+//! | Suspended state ([`Suspendable`])       | 415          |
+//!
+//! Sizes are `core::mem::size_of` values reported by `mem_usage_benches/bench_sha3_mem_usage.rs`
+//! (`cargo run --release -p mem_usage_benches --bin bench_sha3_mem_usage`), which also has valgrind
+//! massif entry points for measuring peak stack usage of the hash, XOF and suspend/resume paths.
+//!
+//! # Security Considerations
+//!
+//! * SHA3-224/256/384/512 offer 112/128/192/256 bits of collision resistance respectively; SHAKE128
+//!   and SHAKE256 offer 128 and 256 bits of security for output lengths at least twice that size
+//!   (FIPS 202 Appendix A.1).
+//! * SHAKE is an XOF, not a hash: `SHAKE128(m, 32)` is a prefix of `SHAKE128(m, 64)`. If the output
+//!   length must be bound to the digest, include it in the message (FIPS 202 Appendix A.2).
+//! * The sponge state and queue are held in [`bouncycastle_utils::secret::Secret`] and zeroized on
+//!   drop.
+//!
 //! # Suspending and resuming execution
 //!
 //! When hashing a large message, it can be advantageous to be able to suspend the operation
@@ -160,17 +185,17 @@ mod sha3;
 mod shake;
 
 /*** String constants ***/
-///
+/// Algorithm name string for SHA3-224, as used by the factories and CLI.
 pub const SHA3_224_NAME: &str = "SHA3-224";
-///
+/// Algorithm name string for SHA3-256, as used by the factories and CLI.
 pub const SHA3_256_NAME: &str = "SHA3-256";
-///
+/// Algorithm name string for SHA3-384, as used by the factories and CLI.
 pub const SHA3_384_NAME: &str = "SHA3-384";
-///
+/// Algorithm name string for SHA3-512, as used by the factories and CLI.
 pub const SHA3_512_NAME: &str = "SHA3-512";
-///
+/// Algorithm name string for SHAKE128, as used by the factories and CLI.
 pub const SHAKE128_NAME: &str = "SHAKE128";
-///
+/// Algorithm name string for SHAKE256, as used by the factories and CLI.
 pub const SHAKE256_NAME: &str = "SHAKE256";
 
 /*** pub types ***/
@@ -205,11 +230,13 @@ trait SHA3Params: HashAlgParams {
 
 // TODO: it would probably be more elegant to macro these.
 
-impl HashAlgParams for SHA3_224 {
-    const OUTPUT_LEN: usize = 28;
-    // const BLOCK_LEN: usize = 64;
-    const BLOCK_LEN: usize = 144; // FIPS 202 Table 3
+/// The public hash types expose the same parameters as their `*Params` marker, so the constants
+/// are defined exactly once (on the params struct) and forwarded here.
+impl<PARAMS: SHA3Params> HashAlgParams for SHA3Internal<PARAMS> {
+    const OUTPUT_LEN: usize = PARAMS::OUTPUT_LEN;
+    const BLOCK_LEN: usize = PARAMS::BLOCK_LEN;
 }
+
 /// The parameters for SHA3_224.
 #[derive(Clone)]
 pub struct SHA3_224Params;
@@ -219,7 +246,6 @@ impl Algorithm for SHA3_224Params {
 }
 impl HashAlgParams for SHA3_224Params {
     const OUTPUT_LEN: usize = 28;
-    // const BLOCK_LEN: usize = 64;
     const BLOCK_LEN: usize = 144; // FIPS 202 Table 3
 }
 impl SHA3Params for SHA3_224Params {
@@ -233,11 +259,6 @@ impl AlgorithmOID for SHA3_224 {
         &[0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x07];
 }
 
-impl HashAlgParams for SHA3_256 {
-    const OUTPUT_LEN: usize = 32;
-    // const BLOCK_LEN: usize = 64;
-    const BLOCK_LEN: usize = 136; // FIPS 202 Table 3
-}
 /// The parameters for SHA3_256.
 #[derive(Clone)]
 pub struct SHA3_256Params;
@@ -247,7 +268,6 @@ impl Algorithm for SHA3_256Params {
 }
 impl HashAlgParams for SHA3_256Params {
     const OUTPUT_LEN: usize = 32;
-    // const BLOCK_LEN: usize = 64;
     const BLOCK_LEN: usize = 136; // FIPS 202 Table 3
 }
 impl SHA3Params for SHA3_256Params {
@@ -263,18 +283,12 @@ impl AlgorithmOID for SHA3_256 {
 /// The parameters for SHA3_384.
 #[derive(Clone)]
 pub struct SHA3_384Params;
-impl HashAlgParams for SHA3_384 {
-    const OUTPUT_LEN: usize = 48;
-    // const BLOCK_LEN: usize = 128;
-    const BLOCK_LEN: usize = 104; // FIPS 202 Table 3
-}
 impl Algorithm for SHA3_384Params {
     const ALG_NAME: &'static str = SHA3_384_NAME;
     const MAX_SECURITY_STRENGTH: SecurityStrength = SecurityStrength::_192bit;
 }
 impl HashAlgParams for SHA3_384Params {
     const OUTPUT_LEN: usize = 48;
-    // const BLOCK_LEN: usize = 128;
     const BLOCK_LEN: usize = 104; // FIPS 202 Table 3
 }
 impl SHA3Params for SHA3_384Params {
@@ -290,18 +304,12 @@ impl AlgorithmOID for SHA3_384 {
 /// The parameters for SHA3_512.
 #[derive(Clone)]
 pub struct SHA3_512Params;
-impl HashAlgParams for SHA3_512 {
-    const OUTPUT_LEN: usize = 64;
-    // const BLOCK_LEN: usize = 128;
-    const BLOCK_LEN: usize = 72; // FIPS 202 Table 3
-}
 impl Algorithm for SHA3_512Params {
     const ALG_NAME: &'static str = SHA3_512_NAME;
     const MAX_SECURITY_STRENGTH: SecurityStrength = SecurityStrength::_256bit;
 }
 impl HashAlgParams for SHA3_512Params {
     const OUTPUT_LEN: usize = 64;
-    // const BLOCK_LEN: usize = 128;
     const BLOCK_LEN: usize = 72; // FIPS 202 Table 3
 }
 impl SHA3Params for SHA3_512Params {
diff --git a/crypto/sha3/src/sha3.rs b/crypto/sha3/src/sha3.rs
index 3da20b0b..5a2c395a 100644
--- a/crypto/sha3/src/sha3.rs
+++ b/crypto/sha3/src/sha3.rs
@@ -15,7 +15,7 @@ use bouncycastle_utils::{max, min};
 /// provided and NIST-approved parameters.
 #[derive(Clone)]
 pub struct SHA3Internal<PARAMS: SHA3Params> {
-    _params: std::marker::PhantomData<PARAMS>,
+    _params: core::marker::PhantomData<PARAMS>,
     keccak: KeccakInternal,
     kdf_key_type: KeyType,
     kdf_security_strength: SecurityStrength,
@@ -28,7 +28,7 @@ impl<PARAMS: SHA3Params> SHA3Internal<PARAMS> {
     /// Get a new SHA3 instance, ready for use.
     pub fn new() -> Self {
         Self {
-            _params: std::marker::PhantomData,
+            _params: core::marker::PhantomData,
             keccak: KeccakInternal::new(PARAMS::SIZE),
             kdf_key_type: KeyType::Zeroized,
             kdf_security_strength: SecurityStrength::None,
@@ -44,6 +44,49 @@ impl<PARAMS: SHA3Params> SHA3Internal<PARAMS> {
         self.do_final_out(output)
     }
 
+    /// Appends the SHA3 domain-separation suffix and pads as per FIPS 202 s. 6.1, then squeezes the digest.
+    ///
+    /// Private, infallible body shared by [`Hash::do_final_out`] and [`Hash::do_final_partial_bits_out`].
+    /// `num_partial_bits` (0..=7, validated by the caller) trailing message bits are taken from the
+    /// least significant bits of `partial_byte` (FIPS 202 Appendix B.1 bit ordering). FIPS 202 s. 6.1
+    /// defines SHA3-d(M) = KECCAK[c](M || 01, d), so the two suffix bits are appended directly above
+    /// the message bits; pad10*1 is then applied by the sponge when it switches to squeezing.
+    ///
+    /// Returns the number of bytes written (`min(output.len(), OUTPUT_LEN)`); a shorter output buffer
+    /// truncates the digest, a longer one is zero-filled past the digest.
+    fn do_final_bits_out(
+        mut self,
+        partial_byte: u8,
+        num_partial_bits: usize,
+        output: &mut [u8],
+    ) -> usize {
+        debug_assert!(num_partial_bits <= 7);
+        output.fill(0);
+
+        // Mutants note: This is just bit-setting into empty space.
+        // It works the same regardless of whether it's OR or XOR.
+        let mut final_input: u16 =
+            ((partial_byte as u16) & ((1 << num_partial_bits) - 1)) | (0x02 << num_partial_bits);
+        let mut final_bits = num_partial_bits + 2;
+
+        // If message bits + suffix fill a whole byte, absorb it as a normal byte first.
+        if final_bits >= 8 {
+            self.keccak.absorb(&[final_input as u8]);
+            final_bits -= 8;
+            final_input >>= 8;
+        }
+
+        // Infallible: the queue is byte-aligned here, final_bits is in 0..=7 by construction, and a
+        // Hash object cannot have started squeezing (do_final_bits_out consumes self and is the only squeeze path).
+        self.keccak
+            .absorb_bits(final_input as u8, final_bits)
+            .expect("absorb_bits is infallible on a byte-aligned, not-yet-squeezing Hash");
+
+        // Truncate to OUTPUT_LEN if the caller supplied a larger buffer (see the Hash trait docs).
+        let n = *min(&output.len(), &PARAMS::OUTPUT_LEN);
+        self.keccak.squeeze(&mut output[..n])
+    }
+
     fn mix_key_internal(&mut self, key: &impl KeyMaterialTrait) {
         // track the strongest input key type
         self.kdf_key_type = *max(&self.kdf_key_type, &key.key_type());
@@ -52,12 +95,11 @@ impl<PARAMS: SHA3Params> SHA3Internal<PARAMS> {
         if key.is_full_entropy() {
             self.kdf_entropy += key.key_len();
             self.kdf_security_strength =
-                max(&self.kdf_security_strength, &key.security_strength()).clone();
-            self.kdf_security_strength = min(
+                *max(&self.kdf_security_strength, &key.security_strength());
+            self.kdf_security_strength = *min(
                 &self.kdf_security_strength,
                 &SecurityStrength::from_bits(PARAMS::OUTPUT_LEN * 8 / 2),
-            )
-            .clone();
+            );
         }
 
         self.do_update(key.ref_to_bytes())
@@ -82,14 +124,14 @@ impl<PARAMS: SHA3Params> SHA3Internal<PARAMS> {
         // it requires full-entropy input that is at least block length.
         // TODO: citation needed (NIST)
         if self.kdf_entropy < PARAMS::OUTPUT_LEN {
-            self.kdf_key_type = min(&self.kdf_key_type, &KeyType::Unknown).clone();
+            self.kdf_key_type = *min(&self.kdf_key_type, &KeyType::Unknown);
             self.kdf_security_strength = SecurityStrength::None; // BytesLowEntropy can't have a securtiy level.
         }
 
         self.do_update(additional_input);
 
-        let mut key_type = self.kdf_key_type.clone();
-        let output_security_strength = self.kdf_security_strength.clone();
+        let mut key_type = self.kdf_key_type;
+        let output_security_strength = self.kdf_security_strength;
         let mut bytes_written: usize = 0;
         key_material::do_hazardous_operations(output_key, |output_key| {
             bytes_written = self.do_final_out(output_key.ref_to_bytes_mut()?);
@@ -107,16 +149,17 @@ impl<PARAMS: SHA3Params> SHA3Internal<PARAMS> {
         }
         key_material::do_hazardous_operations(&mut *output_key, |output_key| {
             output_key.set_key_type(key_type)?;
-            output_key.set_security_strength(
-                min(&output_security_strength, &SecurityStrength::from_bits(bytes_written * 8)).clone(),
-            )
+            output_key.set_security_strength(*min(
+                &output_security_strength,
+                &SecurityStrength::from_bits(bytes_written * 8),
+            ))
         })
         .expect(
             "both set_key_type() and set_security_strength() should be infallible within a hazop block",
         );
 
         output_key
-            .set_key_len(min(&output_key.key_len(), &PARAMS::OUTPUT_LEN).clone())
+            .set_key_len(*min(&output_key.key_len(), &PARAMS::OUTPUT_LEN))
             .expect("should be infallible to truncate key length");
         Ok(bytes_written)
     }
@@ -150,10 +193,8 @@ impl<PARAMS: SHA3Params> Hash for SHA3Internal<PARAMS> {
         output
     }
 
-    fn hash_out(self, data: &[u8], mut output: &mut [u8]) -> usize {
-        output.fill(0);
-
-        self.hash_internal(data, &mut output)
+    fn hash_out(self, data: &[u8], output: &mut [u8]) -> usize {
+        self.hash_internal(data, output)
     }
 
     fn do_update(&mut self, data: &[u8]) {
@@ -171,21 +212,9 @@ impl<PARAMS: SHA3Params> Hash for SHA3Internal<PARAMS> {
 
     // TODO: investigate why this doesn't take a &mut [u8; HASH_LEN]
     // Being able to do so would improve ergonomics
-    fn do_final_out(mut self, output: &mut [u8]) -> usize {
-        output.fill(0);
-
-        // this shouldn't fail because, by construction, the function is only called once,
-        // and this is the only way to absorb partial bits.
-        self.keccak.absorb_bits(0x02, 2).expect("do_final_out: keccak.absorb_bits failed.");
-
-        let bytes_written = if output.len() <= self.output_len() {
-            self.keccak.squeeze(output)
-        } else {
-            let min =
-                if output.len() >= self.output_len() { self.output_len() } else { output.len() };
-            self.keccak.squeeze(&mut output[..min])
-        };
-        bytes_written
+    fn do_final_out(self, output: &mut [u8]) -> usize {
+        // A whole-byte message is the zero-partial-bits case of the general finalization.
+        self.do_final_bits_out(0, 0, output)
     }
 
     fn do_final_partial_bits(
@@ -193,39 +222,22 @@ impl<PARAMS: SHA3Params> Hash for SHA3Internal<PARAMS> {
         partial_byte: u8,
         num_partial_bits: usize,
     ) -> Result<Vec<u8>, HashError> {
-        let dbg_rslt_len = self.output_len();
-        let mut output: Vec<u8> = vec![0u8; self.output_len()];
-        let bytes_written =
-            self.do_final_partial_bits_out(partial_byte, num_partial_bits, output.as_mut_slice())?;
-        debug_assert_eq!(bytes_written, dbg_rslt_len);
-
+        let mut output: Vec<u8> = vec![0u8; PARAMS::OUTPUT_LEN];
+        self.do_final_partial_bits_out(partial_byte, num_partial_bits, &mut output)?;
         Ok(output)
     }
 
     fn do_final_partial_bits_out(
-        mut self,
+        self,
         partial_byte: u8,
         num_partial_bits: usize,
         output: &mut [u8],
     ) -> Result<usize, HashError> {
-        output.fill(0);
-
-        // Mutants note: This is just bit-setting into empty space.
-        // It works the same regardless of whether it's OR or XOR.
-        let mut final_input: u16 =
-            ((partial_byte as u16) & ((1 << num_partial_bits) - 1)) | (0x02 << num_partial_bits);
-        let mut final_bits = num_partial_bits + 2;
-
-        if final_bits >= 8 {
-            self.keccak.absorb(&[final_input as u8]);
-            final_bits -= 8;
-            final_input >>= 8;
+        // A partial byte has at most 7 bits; 0 means the message ends on a byte boundary.
+        if num_partial_bits > 7 {
+            return Err(HashError::InvalidLength("num_partial_bits must be in the range [0,7]"));
         }
-
-        self.keccak.absorb_bits(final_input as u8, final_bits)?;
-
-        let min = if output.len() >= self.output_len() { self.output_len() } else { output.len() };
-        Ok(self.keccak.squeeze(&mut output[..min]))
+        Ok(self.do_final_bits_out(partial_byte, num_partial_bits, output))
     }
 
     fn max_security_strength(&self) -> SecurityStrength {
@@ -321,7 +333,7 @@ impl<PARAMS: SHA3Params> Suspendable<SUSPENDED_SHA3_STATE_LEN> for SHA3Internal<
             deserialize_sha3_family_state(input, PARAMS::STATE_TAG, rate)?;
 
         Ok(SHA3Internal {
-            _params: std::marker::PhantomData,
+            _params: core::marker::PhantomData,
             keccak,
             kdf_key_type,
             kdf_security_strength,
diff --git a/crypto/sha3/src/shake.rs b/crypto/sha3/src/shake.rs
index 6ba2a882..8bb65b8e 100644
--- a/crypto/sha3/src/shake.rs
+++ b/crypto/sha3/src/shake.rs
@@ -76,12 +76,11 @@ impl<PARAMS: SHAKEParams> SHAKEInternal<PARAMS> {
         if key.is_full_entropy() {
             self.kdf_entropy += key.key_len();
             self.kdf_security_strength =
-                max(&self.kdf_security_strength, &key.security_strength()).clone();
-            self.kdf_security_strength = min(
+                *max(&self.kdf_security_strength, &key.security_strength());
+            self.kdf_security_strength = *min(
                 &self.kdf_security_strength,
                 &SecurityStrength::from_bits(PARAMS::SIZE as usize),
-            )
-            .clone();
+            );
         }
 
         // Infallible: mix_key_internal is only called during the absorb phase, before any squeeze.
@@ -117,7 +116,7 @@ impl<PARAMS: SHAKEParams> SHAKEInternal<PARAMS> {
         // TODO: The intuition behind this is that SHAKE256 and SHA3-256 are both KECCAK[512], and SHAKE128 is KECCAK[256],
         // TODO: However, it is necessary to find an actual reference for this "fully-seeded" threshold.
         if self.kdf_entropy < 2 * (PARAMS::SIZE as usize) / 8 {
-            self.kdf_key_type = min(&self.kdf_key_type, &KeyType::Unknown).clone();
+            self.kdf_key_type = *min(&self.kdf_key_type, &KeyType::Unknown);
             self.kdf_security_strength = SecurityStrength::None; // BytesLowEntropy can't have a securtiy level.
         }
 
@@ -139,10 +138,10 @@ impl<PARAMS: SHAKEParams> SHAKEInternal<PARAMS> {
         }
         key_material::do_hazardous_operations(output_key, |output_key| {
             output_key.set_key_type(self.kdf_key_type)?;
-            output_key.set_security_strength(
-                min(&self.kdf_security_strength, &SecurityStrength::from_bits(bytes_written * 8))
-                    .clone(),
-            )
+            output_key.set_security_strength(*min(
+                &self.kdf_security_strength,
+                &SecurityStrength::from_bits(bytes_written * 8),
+            ))
         })?;
         Ok(bytes_written)
     }
@@ -270,8 +269,7 @@ impl<PARAMS: SHAKEParams> XOF for SHAKEInternal<PARAMS> {
     }
 
     fn hash_xof_out(self, data: &[u8], output: &mut [u8]) -> usize {
-        output.fill(0);
-
+        // hash_internal_out zeroizes `output` before writing.
         self.hash_internal_out(data, output)
     }
 
@@ -304,8 +302,9 @@ impl<PARAMS: SHAKEParams> XOF for SHAKEInternal<PARAMS> {
         if self.keccak.squeezing {
             return Err(HashError::InvalidState("cannot absorb after squeezing has begun"));
         }
-        if !(1..=7).contains(&num_partial_bits) {
-            return Err(HashError::InvalidLength("must be in the range [0,7]"));
+        // A partial byte has at most 7 bits; 0 means the message ends on a byte boundary.
+        if num_partial_bits > 7 {
+            return Err(HashError::InvalidLength("num_partial_bits must be in the range [0,7]"));
         }
         // Mutants note: This is just bit-setting into empty space.
         // It works the same regardless of whether it's OR or XOR.
@@ -355,14 +354,16 @@ impl<PARAMS: SHAKEParams> XOF for SHAKEInternal<PARAMS> {
         output: &mut u8,
     ) -> Result<(), HashError> {
         if !(1..=7).contains(&num_bits) {
-            return Err(HashError::InvalidLength("must be in the range [0,7]"));
+            return Err(HashError::InvalidLength("num_bits must be in the range [1,7]"));
         }
 
         *output = 0;
 
+        // Via squeeze_out() so the SHAKE "1111" suffix (FIPS 202 s. 6.2) is applied on a first squeeze.
         let mut buf = [0u8; 1];
-        self.keccak.squeeze(&mut buf);
-        *output = buf[0] >> 8 - num_bits;
+        self.squeeze_out(&mut buf);
+
+        *output = buf[0] & ((1u8 << num_bits) - 1);
         Ok(())
     }
 
diff --git a/crypto/sha3/tests/cavp_tests.rs b/crypto/sha3/tests/cavp_tests.rs
new file mode 100644
index 00000000..54069c88
--- /dev/null
+++ b/crypto/sha3/tests/cavp_tests.rs
@@ -0,0 +1,391 @@
+//! NIST CAVP SHA3VS test vectors for SHA3-224/256/384/512 and SHAKE128/256.
+//!
+//! Vectors are read from the bc-test-data repo (https://github.com/bcgit/bc-test-data), which must be
+//! cloned alongside this repo at "../bc-test-data" (same convention as the mldsa/mlkem/sha2 crates),
+//! under `crypto/sha3/{bit-oriented,byte-oriented}/`. If it is not present the tests print a warning
+//! and pass vacuously.
+//!
+//! Bit ordering: unlike the SHA-2 CAVP files, SHA-3 CAVP follows FIPS 202 Appendix B.1 — the excess
+//! bits of a `Len`-bit message occupy the *least significant* bits of the final `Msg` byte, and the
+//! excess bits of an `Outputlen`-bit SHAKE output occupy the least significant bits of the final
+//! `Output` byte (verified over every partial case in the files: all high bits are zero). This is
+//! exactly the convention of [`Hash::do_final_partial_bits`] / [`XOF::absorb_last_partial_byte`] /
+//! [`XOF::squeeze_partial_byte_final`], so no shifting is needed.
+//!
+//! Test types exercised (SHA3VS s. 6):
+//!
+//!  * SHA3 ShortMsg / LongMsg — `Len` (bits), `Msg`, `MD`.
+//!  * SHA3 Monte (s. 6.2.2) — `MD0 = Seed`; for i in 1..=1000: `MDi = SHA3(MDi-1)`; report `MD1000`
+//!    per COUNT and reseed with it.
+//!  * SHAKE ShortMsg / LongMsg — `Len` (bits), `Msg`, `Output` at the fixed `[Outputlen]` of the file.
+//!  * SHAKE VariableOut — `Outputlen` (bits, not necessarily a multiple of 8), `Msg`, `Output`.
+//!  * SHAKE Monte (s. 6.2.3) — `Outputlen = maxoutlen`; for i in 1..=1000: `Msg = leftmost 128 bits
+//!    of the previous Output (zero-padded)`, `Output = SHAKE(Msg, Outputlen)`, then
+//!    `Outputlen = minoutbytes + (rightmost 16 bits of Output as big-endian integer) mod
+//!    (maxoutbytes - minoutbytes + 1)` bytes; report `Output`/`Outputlen` per COUNT.
+
+use bouncycastle_core::traits::{Hash, XOF};
+use bouncycastle_hex as hex;
+use bouncycastle_sha3::{SHA3_224, SHA3_256, SHA3_384, SHA3_512, SHAKE128, SHAKE256};
+use std::fs;
+use std::path::Path;
+use std::sync::Once;
+
+const TEST_DATA_PATH_RELATIVE: &str = "../../../bc-test-data/crypto/sha3";
+const TEST_DATA_PATH: &str = "../bc-test-data/crypto/sha3";
+
+static TEST_DATA_CHECK: Once = Once::new();
+
+/// Returns the contents of `<orientation>/<filename>` from bc-test-data, or `None` (after a one-time
+/// warning) if the repo is not checked out.
+fn get_test_data(orientation: &str, filename: &str) -> Option<String> {
+    let dir = [TEST_DATA_PATH_RELATIVE, TEST_DATA_PATH].into_iter().find(|d| Path::new(d).exists());
+    TEST_DATA_CHECK.call_once(|| match dir {
+        Some(d) => println!("bc-test-data found at: {d:?}"),
+        None => println!("WARNING: bc-test-data directory not found; CAVP tests will be skipped"),
+    });
+    let dir = dir?;
+    Some(
+        fs::read_to_string(format!("{dir}/{orientation}/{filename}"))
+            .expect("failed to read CAVP test vector file"),
+    )
+}
+
+/// Splits a `Key = value` or `[Key = value]` line from a `.rsp` file.
+fn kv(line: &str) -> Option<(&str, &str)> {
+    let line = line.trim().trim_start_matches('[').trim_end_matches(']');
+    let (k, v) = line.split_once('=')?;
+    Some((k.trim(), v.trim()))
+}
+
+fn parse_hex(v: &str) -> Vec<u8> {
+    hex::decode(v).expect("bad hex")
+}
+
+fn parse_num(v: &str) -> usize {
+    v.parse().expect("bad number")
+}
+
+// ---------------------------------------------------------------------------------------------
+// SHA3 (fixed-length) tests
+// ---------------------------------------------------------------------------------------------
+
+struct MsgCase {
+    len_bits: usize,
+    msg: Vec<u8>,
+    md: Vec<u8>,
+}
+
+/// Parses a SHA3 ShortMsg/LongMsg or SHAKE ShortMsg/LongMsg file into `(Len, Msg, MD|Output)`.
+fn parse_msg_file(content: &str) -> Vec<MsgCase> {
+    let mut cases = vec![];
+    let (mut len_bits, mut msg) = (None, None);
+    for line in content.lines() {
+        let Some((k, v)) = kv(line) else { continue };
+        match k {
+            "Len" => len_bits = Some(parse_num(v)),
+            "Msg" => msg = Some(parse_hex(v)),
+            "MD" | "Output" => cases.push(MsgCase {
+                len_bits: len_bits.take().expect("digest without Len"),
+                msg: msg.take().expect("digest without Msg"),
+                md: parse_hex(v),
+            }),
+            _ => {}
+        }
+    }
+    cases
+}
+
+/// Hashes the first `len_bits` bits of `msg` (FIPS 202 B.1 packing: excess bits in the LSBs).
+fn sha3_bits<H: Hash + Default>(msg: &[u8], len_bits: usize) -> Vec<u8> {
+    let whole_bytes = len_bits / 8;
+    let partial_bits = len_bits % 8;
+    if partial_bits == 0 {
+        // CAVP writes `Msg = 00` for Len = 0, so always slice rather than using msg directly.
+        H::default().hash(&msg[..whole_bytes])
+    } else {
+        let mut h = H::default();
+        h.do_update(&msg[..whole_bytes]);
+        h.do_final_partial_bits(msg[whole_bytes], partial_bits).expect("partial_bits is in 1..=7")
+    }
+}
+
+fn run_sha3_msg_file<H: Hash + Default>(orientation: &str, filename: &str) {
+    let Some(content) = get_test_data(orientation, filename) else { return };
+    let cases = parse_msg_file(&content);
+    assert!(!cases.is_empty(), "{orientation}/{filename}: no test cases parsed");
+    let mut partial_cases = 0;
+    for c in &cases {
+        partial_cases += usize::from(c.len_bits % 8 != 0);
+        assert_eq!(
+            sha3_bits::<H>(&c.msg, c.len_bits),
+            c.md,
+            "{orientation}/{filename}: Len = {}",
+            c.len_bits
+        );
+    }
+    if orientation == "bit-oriented" {
+        assert!(partial_cases > 0, "{orientation}/{filename}: expected bit-length cases");
+    }
+    println!("{orientation}/{filename}: {} cases ({partial_cases} bit-length)", cases.len());
+}
+
+/// SHA3VS s. 6.2.2 Monte Carlo test for the fixed-length SHA3 functions.
+fn run_sha3_monte_file<H: Hash + Default>(orientation: &str, filename: &str) {
+    let Some(content) = get_test_data(orientation, filename) else { return };
+    let mut seed = None;
+    let mut mds = vec![];
+    for line in content.lines() {
+        let Some((k, v)) = kv(line) else { continue };
+        match k {
+            "Seed" => seed = Some(parse_hex(v)),
+            "MD" => mds.push(parse_hex(v)),
+            _ => {}
+        }
+    }
+    let mut md = seed.expect("Monte file without Seed");
+    assert_eq!(mds.len(), 100, "{orientation}/{filename}: expected 100 COUNTs");
+    for (count, expected) in mds.iter().enumerate() {
+        // MD0 = Seed; for i = 1 to 1000: MDi = SHA3(MDi-1); MDj = MD1000; Seed = MDj
+        for _ in 1..=1000 {
+            md = H::default().hash(&md);
+        }
+        assert_eq!(&md, expected, "{orientation}/{filename}: COUNT = {count}");
+    }
+    println!("{orientation}/{filename}: {} counts", mds.len());
+}
+
+// ---------------------------------------------------------------------------------------------
+// SHAKE tests
+// ---------------------------------------------------------------------------------------------
+
+/// SHAKE of the first `len_bits` bits of `msg`, producing `out_bits` bits of output (FIPS 202 B.1
+/// packing on both sides: excess bits in the LSBs of the final byte).
+fn shake_bits<X: XOF + Default>(msg: &[u8], len_bits: usize, out_bits: usize) -> Vec<u8> {
+    let mut x = X::default();
+    let (whole, partial) = (len_bits / 8, len_bits % 8);
+    x.absorb(&msg[..whole]).expect("absorb before squeeze is infallible");
+    if partial != 0 {
+        x.absorb_last_partial_byte(msg[whole], partial).expect("partial is in 1..=7");
+    }
+    let (out_whole, out_partial) = (out_bits / 8, out_bits % 8);
+    let mut out = x.squeeze(out_whole);
+    if out_partial != 0 {
+        out.push(x.squeeze_partial_byte_final(out_partial).expect("out_partial is in 1..=7"));
+    }
+    out
+}
+
+fn run_shake_msg_file<X: XOF + Default>(orientation: &str, filename: &str) {
+    let Some(content) = get_test_data(orientation, filename) else { return };
+    let out_bits = content
+        .lines()
+        .filter_map(kv)
+        .find(|(k, _)| *k == "Outputlen")
+        .map(|(_, v)| parse_num(v))
+        .expect("missing [Outputlen = N] header");
+    let cases = parse_msg_file(&content);
+    assert!(!cases.is_empty(), "{orientation}/{filename}: no test cases parsed");
+    let mut partial_cases = 0;
+    for c in &cases {
+        partial_cases += usize::from(c.len_bits % 8 != 0);
+        assert_eq!(c.md.len() * 8, out_bits);
+        assert_eq!(
+            shake_bits::<X>(&c.msg, c.len_bits, out_bits),
+            c.md,
+            "{orientation}/{filename}: Len = {}",
+            c.len_bits
+        );
+    }
+    if orientation == "bit-oriented" {
+        assert!(partial_cases > 0, "{orientation}/{filename}: expected bit-length cases");
+    }
+    println!("{orientation}/{filename}: {} cases ({partial_cases} bit-length)", cases.len());
+}
+
+struct VarOutCase {
+    out_bits: usize,
+    msg: Vec<u8>,
+    output: Vec<u8>,
+}
+
+fn run_shake_variable_out_file<X: XOF + Default>(orientation: &str, filename: &str) {
+    let Some(content) = get_test_data(orientation, filename) else { return };
+    let mut cases = vec![];
+    let (mut out_bits, mut msg) = (None, None);
+    for line in content.lines() {
+        let Some((k, v)) = kv(line) else { continue };
+        match k {
+            "Outputlen" => out_bits = Some(parse_num(v)),
+            "Msg" => msg = Some(parse_hex(v)),
+            "Output" => cases.push(VarOutCase {
+                out_bits: out_bits.take().expect("Output without Outputlen"),
+                msg: msg.take().expect("Output without Msg"),
+                output: parse_hex(v),
+            }),
+            _ => {}
+        }
+    }
+    assert!(!cases.is_empty(), "{orientation}/{filename}: no test cases parsed");
+    let mut partial_cases = 0;
+    for (i, c) in cases.iter().enumerate() {
+        partial_cases += usize::from(c.out_bits % 8 != 0);
+        assert_eq!(c.output.len(), c.out_bits.div_ceil(8));
+        assert_eq!(
+            shake_bits::<X>(&c.msg, c.msg.len() * 8, c.out_bits),
+            c.output,
+            "{orientation}/{filename}: COUNT = {i}, Outputlen = {}",
+            c.out_bits
+        );
+    }
+    if orientation == "bit-oriented" {
+        assert!(partial_cases > 0, "{orientation}/{filename}: expected bit-length outputs");
+    }
+    println!(
+        "{orientation}/{filename}: {} cases ({partial_cases} bit-length outputs)",
+        cases.len()
+    );
+}
+
+/// SHA3VS s. 6.2.3 Monte Carlo test for SHAKE.
+fn run_shake_monte_file<X: XOF + Default>(orientation: &str, filename: &str) {
+    let Some(content) = get_test_data(orientation, filename) else { return };
+    let (mut min_bits, mut max_bits, mut msg) = (None, None, None);
+    let mut expected: Vec<(usize, Vec<u8>)> = vec![];
+    let mut out_len = None;
+    for line in content.lines() {
+        let Some((k, v)) = kv(line) else { continue };
+        match k {
+            "Minimum Output Length (bits)" => min_bits = Some(parse_num(v)),
+            "Maximum Output Length (bits)" => max_bits = Some(parse_num(v)),
+            "Msg" => msg = Some(parse_hex(v)),
+            "Outputlen" => out_len = Some(parse_num(v)),
+            "Output" => {
+                expected.push((out_len.take().expect("Output without Outputlen"), parse_hex(v)))
+            }
+            _ => {}
+        }
+    }
+    let min_bytes = min_bits.expect("missing min output length") / 8;
+    let max_bytes = max_bits.expect("missing max output length") / 8;
+    let range = max_bytes - min_bytes + 1;
+    let mut output = msg.expect("Monte file without Msg");
+    assert_eq!(output.len(), 16, "seed Msg must be 128 bits");
+    assert_eq!(expected.len(), 100, "{orientation}/{filename}: expected 100 COUNTs");
+
+    // Outputlen = maxoutlen (initially)
+    let mut out_bytes = max_bytes;
+    for (count, (exp_bits, exp_output)) in expected.iter().enumerate() {
+        for _ in 1..=1000 {
+            // Msg = leftmost 128 bits of Output, zero-padded if Output is shorter
+            let mut m = [0u8; 16];
+            let n = output.len().min(16);
+            m[..n].copy_from_slice(&output[..n]);
+            // Output = SHAKE(Msg, Outputlen)
+            output = X::default().hash_xof(&m, out_bytes);
+            // Rightmost_Output_bits = rightmost 16 bits of Output (big-endian integer)
+            let l = output.len();
+            let rightmost = u16::from_be_bytes([output[l - 2], output[l - 1]]) as usize;
+            // Outputlen = minoutbytes + (Rightmost_Output_bits mod Range)
+            out_bytes = min_bytes + (rightmost % range);
+        }
+        assert_eq!(
+            output.len() * 8,
+            *exp_bits,
+            "{orientation}/{filename}: COUNT = {count} Outputlen"
+        );
+        assert_eq!(&output, exp_output, "{orientation}/{filename}: COUNT = {count}");
+    }
+    println!("{orientation}/{filename}: {} counts", expected.len());
+}
+
+// ---------------------------------------------------------------------------------------------
+// Test matrix
+// ---------------------------------------------------------------------------------------------
+
+macro_rules! sha3_cavp_tests {
+    ($mod:ident, $hash:ty, $prefix:literal) => {
+        mod $mod {
+            use super::*;
+
+            #[test]
+            fn bit_oriented_short_msg() {
+                run_sha3_msg_file::<$hash>("bit-oriented", concat!($prefix, "ShortMsg.rsp"));
+            }
+            #[test]
+            fn bit_oriented_long_msg() {
+                run_sha3_msg_file::<$hash>("bit-oriented", concat!($prefix, "LongMsg.rsp"));
+            }
+            #[test]
+            fn bit_oriented_monte() {
+                run_sha3_monte_file::<$hash>("bit-oriented", concat!($prefix, "Monte.rsp"));
+            }
+            #[test]
+            fn byte_oriented_short_msg() {
+                run_sha3_msg_file::<$hash>("byte-oriented", concat!($prefix, "ShortMsg.rsp"));
+            }
+            #[test]
+            fn byte_oriented_long_msg() {
+                run_sha3_msg_file::<$hash>("byte-oriented", concat!($prefix, "LongMsg.rsp"));
+            }
+            #[test]
+            fn byte_oriented_monte() {
+                run_sha3_monte_file::<$hash>("byte-oriented", concat!($prefix, "Monte.rsp"));
+            }
+        }
+    };
+}
+
+macro_rules! shake_cavp_tests {
+    ($mod:ident, $xof:ty, $prefix:literal) => {
+        mod $mod {
+            use super::*;
+
+            #[test]
+            fn bit_oriented_short_msg() {
+                run_shake_msg_file::<$xof>("bit-oriented", concat!($prefix, "ShortMsg.rsp"));
+            }
+            #[test]
+            fn bit_oriented_long_msg() {
+                run_shake_msg_file::<$xof>("bit-oriented", concat!($prefix, "LongMsg.rsp"));
+            }
+            #[test]
+            fn bit_oriented_variable_out() {
+                run_shake_variable_out_file::<$xof>(
+                    "bit-oriented",
+                    concat!($prefix, "VariableOut.rsp"),
+                );
+            }
+            #[test]
+            fn bit_oriented_monte() {
+                run_shake_monte_file::<$xof>("bit-oriented", concat!($prefix, "Monte.rsp"));
+            }
+            #[test]
+            fn byte_oriented_short_msg() {
+                run_shake_msg_file::<$xof>("byte-oriented", concat!($prefix, "ShortMsg.rsp"));
+            }
+            #[test]
+            fn byte_oriented_long_msg() {
+                run_shake_msg_file::<$xof>("byte-oriented", concat!($prefix, "LongMsg.rsp"));
+            }
+            #[test]
+            fn byte_oriented_variable_out() {
+                run_shake_variable_out_file::<$xof>(
+                    "byte-oriented",
+                    concat!($prefix, "VariableOut.rsp"),
+                );
+            }
+            #[test]
+            fn byte_oriented_monte() {
+                run_shake_monte_file::<$xof>("byte-oriented", concat!($prefix, "Monte.rsp"));
+            }
+        }
+    };
+}
+
+sha3_cavp_tests!(sha3_224, SHA3_224, "SHA3_224");
+sha3_cavp_tests!(sha3_256, SHA3_256, "SHA3_256");
+sha3_cavp_tests!(sha3_384, SHA3_384, "SHA3_384");
+sha3_cavp_tests!(sha3_512, SHA3_512, "SHA3_512");
+shake_cavp_tests!(shake128, SHAKE128, "SHAKE128");
+shake_cavp_tests!(shake256, SHAKE256, "SHAKE256");
diff --git a/crypto/sha3/tests/data/SHA3TestVectors.txt b/crypto/sha3/tests/data/SHA3TestVectors.txt
deleted file mode 100644
index c6d0efaf..00000000
--- a/crypto/sha3/tests/data/SHA3TestVectors.txt
+++ /dev/null
@@ -1,837 +0,0 @@
-# Test vectors for FIPS 202 - SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions
-#
-# Downloaded 6th August, 2015 from http://csrc.nist.gov/groups/ST/toolkit/examples.html#aHashing
-#
-# NOTE: The 1605-bit test vectors were initially wrong. Corrections were published on 14th August, 2015
-#       (SHA3-512 corrected on 3rd September, 2015).
-
-SHA3-224 sample of 0-bit message
-
-Msg as bit string
-    #(empty message)
-
-Hash val is
-    6B 4E 03 42 36 67 DB B7 3B 6E 15 45 4F 0E B1 AB
-    D4 59 7F 9A 1B 07 8E 3F 5B 5A 6B C7
-
-SHA3-224 sample of 5-bit message
-
-Msg as bit string
-    1 1 0 0 1
-
-Hash val is
-    FF BA D5 DA 96 BA D7 17 89 33 02 06 DC 67 68 EC
-    AE B1 B3 2D CA 6B 33 01 48 96 74 AB
-
-SHA3-224 sample of 30-bit message
-
-Msg as bit string
-    1 1 0 0 1 0 1 0 0 0 0 1 1 0 1 0 1 1 0 1 1 1 1 0 1 0 0 1 1 0
-
-Hash val is
-    D6 66 A5 14 CC 9D BA 25 AC 1B A6 9E D3 93 04 60
-    DE AA C9 85 1B 5F 0B AA B0 07 DF 3B
-
-SHA3-224 sample of 1600-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-
-Hash val is
-    93 76 81 6A BA 50 3F 72 F9 6C E7 EB 65 AC 09 5D
-    EE E3 BE 4B F9 BB C2 A1 CB 7E 11 E0
-
-SHA3-224 sample of 1605-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0
-
-Hash val is
-    22 D2 F7 BB 0B 17 3F D8 C1 96 86 F9 17 31 66 E3
-    EE 62 73 80 47 D7 EA DD 69 EF B2 28
-
-SHA3-224 sample of 1630-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1
-
-Hash val is
-    4E 90 7B B1 05 78 61 F2 00 A5 99 E9 D4 F8 5B 02
-    D8 84 53 BF 5B 8A CE 9A C5 89 13 4C
-
-SHA3-256 sample of 0-bit message
-
-Msg as bit string
-    #(empty message)
-
-Hash val is
-    A7 FF C6 F8 BF 1E D7 66 51 C1 47 56 A0 61 D6 62
-    F5 80 FF 4D E4 3B 49 FA 82 D8 0A 4B 80 F8 43 4A
-
-SHA3-256 sample of 5-bit message
-
-Msg as bit string
-    1 1 0 0 1
-
-Hash val is
-    7B 00 47 CF 5A 45 68 82 36 3C BF 0F B0 53 22 CF
-    65 F4 B7 05 9A 46 36 5E 83 01 32 E3 B5 D9 57 AF
-
-SHA3-256 sample of 30-bit message
-
-Msg as bit string
-    1 1 0 0 1 0 1 0 0 0 0 1 1 0 1 0 1 1 0 1 1 1 1 0 1 0 0 1 1 0
-
-Hash val is
-    C8 24 2F EF 40 9E 5A E9 D1 F1 C8 57 AE 4D C6 24
-    B9 2B 19 80 9F 62 AA 8C 07 41 1C 54 A0 78 B1 D0
-
-SHA3-256 sample of 1600-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-
-Hash val is
-    79 F3 8A DE C5 C2 03 07 A9 8E F7 6E 83 24 AF BF
-    D4 6C FD 81 B2 2E 39 73 C6 5F A1 BD 9D E3 17 87
-
-SHA3-256 sample of 1605-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0
-
-Hash val is
-    81 EE 76 9B ED 09 50 86 2B 1D DD ED 2E 84 AA A6
-    AB 7B FD D3 CE AA 47 1B E3 11 63 D4 03 36 36 3C
-
-SHA3-256 sample of 1630-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1
-
-Hash val is
-    52 86 0A A3 01 21 4C 61 0D 92 2A 6B 6C AB 98 1C
-    CD 06 01 2E 54 EF 68 9D 74 40 21 E7 38 B9 ED 20
-
-SHA3-384 sample of 0-bit message
-
-Msg as bit string
-    #(empty message)
-
-Hash val is
-    0C 63 A7 5B 84 5E 4F 7D 01 10 7D 85 2E 4C 24 85
-    C5 1A 50 AA AA 94 FC 61 99 5E 71 BB EE 98 3A 2A
-    C3 71 38 31 26 4A DB 47 FB 6B D1 E0 58 D5 F0 04
-
-SHA3-384 sample of 5-bit message
-
-Msg as bit string
-    1 1 0 0 1
-
-Hash val is
-    73 7C 9B 49 18 85 E9 BF 74 28 E7 92 74 1A 7B F8
-    DC A9 65 34 71 C3 E1 48 47 3F 2C 23 6B 6A 0A 64
-    55 EB 1D CE 9F 77 9B 4B 6B 23 7F EF 17 1B 1C 64
-
-SHA3-384 sample of 30-bit message
-
-Msg as bit string
-    1 1 0 0 1 0 1 0 0 0 0 1 1 0 1 0 1 1 0 1 1 1 1 0 1 0 0 1 1 0
-
-Hash val is
-    95 5B 4D D1 BE 03 26 1B D7 6F 80 7A 7E FD 43 24
-    35 C4 17 36 28 11 B8 A5 0C 56 4E 7E E9 58 5E 1A
-    C7 62 6D DE 2F DC 03 0F 87 61 96 EA 26 7F 08 C3
-
-SHA3-384 sample of 1600-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-
-Hash val is
-    18 81 DE 2C A7 E4 1E F9 5D C4 73 2B 8F 5F 00 2B
-    18 9C C1 E4 2B 74 16 8E D1 73 26 49 CE 1D BC DD
-    76 19 7A 31 FD 55 EE 98 9F 2D 70 50 DD 47 3E 8F
-
-SHA3-384 sample of 1605-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0
-
-Hash val is
-    A3 1F DB D8 D5 76 55 1C 21 FB 11 91 B5 4B DA 65
-    B6 C5 FE 97 F0 F4 A6 91 03 42 4B 43 F7 FD B8 35
-    97 9F DB EA E8 B3 FE 16 CB 82 E5 87 38 1E B6 24
-
-SHA3-384 sample of 1630-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1
-
-Hash val is
-    34 85 D3 B2 80 BD 38 4C F4 A7 77 84 4E 94 67 81
-    73 05 5D 1C BC 40 C7 C2 C3 83 3D 9E F1 23 45 17
-    2D 6F CD 31 92 3B B8 79 5A C8 18 47 D3 D8 85 5C
-
-SHA3-512 sample of 0-bit message
-
-Msg as bit string
-    #(empty message)
-
-Hash val is
-    A6 9F 73 CC A2 3A 9A C5 C8 B5 67 DC 18 5A 75 6E
-    97 C9 82 16 4F E2 58 59 E0 D1 DC C1 47 5C 80 A6
-    15 B2 12 3A F1 F5 F9 4C 11 E3 E9 40 2C 3A C5 58
-    F5 00 19 9D 95 B6 D3 E3 01 75 85 86 28 1D CD 26
-
-SHA3-512 sample of 5-bit message
-
-Msg as bit string
-    1 1 0 0 1
-
-Hash val is
-    A1 3E 01 49 41 14 C0 98 00 62 2A 70 28 8C 43 21
-    21 CE 70 03 9D 75 3C AD D2 E0 06 E4 D9 61 CB 27
-    54 4C 14 81 E5 81 4B DC EB 53 BE 67 33 D5 E0 99
-    79 5E 5E 81 91 8A DD B0 58 E2 2A 9F 24 88 3F 37
-
-SHA3-512 sample of 30-bit message
-
-Msg as bit string
-    1 1 0 0 1 0 1 0 0 0 0 1 1 0 1 0 1 1 0 1 1 1 1 0 1 0 0 1 1 0
-
-Hash val is
-    98 34 C0 5A 11 E1 C5 D3 DA 9C 74 0E 1C 10 6D 9E
-    59 0A 0E 53 0B 6F 6A AA 78 30 52 5D 07 5C A5 DB
-    1B D8 A6 AA 98 1A 28 61 3A C3 34 93 4A 01 82 3C
-    D4 5F 45 E4 9B 6D 7E 69 17 F2 F1 67 78 06 7B AB
-
-SHA3-512 sample of 1600-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-
-Hash val is
-    E7 6D FA D2 20 84 A8 B1 46 7F CF 2F FA 58 36 1B
-    EC 76 28 ED F5 F3 FD C0 E4 80 5D C4 8C AE EC A8
-    1B 7C 13 C3 0A DF 52 A3 65 95 84 73 9A 2D F4 6B
-    E5 89 C5 1C A1 A4 A8 41 6D F6 54 5A 1C E8 BA 00
-
-SHA3-512 sample of 1605-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0
-
-Hash val is
-    FC 4A 16 7C CB 31 A9 37 D6 98 FD E8 2B 04 34 8C
-    95 39 B2 8F 0C 9D 3B 45 05 70 9C 03 81 23 50 E4
-    99 0E 96 22 97 4F 6E 57 5C 47 86 1C 0D 2E 63 8C
-    CF C2 02 3C 36 5B B6 0A 93 F5 28 55 06 98 78 6B
-
-SHA3-512 sample of 1630-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1
-
-Hash val is
-    CF 9A 30 AC 1F 1F 6A C0 91 6F 9F EF 19 19 C5 95
-    DE BE 2E E8 0C 85 42 12 10 FD F0 5F 1C 6A F7 3A
-    A9 CA C8 81 D0 F9 1D B6 D0 34 A2 BB AD C1 CF 7F
-    BC B2 EC FA 9D 19 1D 3A 50 16 FB 3F AD 87 09 C9
-
diff --git a/crypto/sha3/tests/data/SHAKETestVectors.txt b/crypto/sha3/tests/data/SHAKETestVectors.txt
deleted file mode 100644
index c31e305a..00000000
--- a/crypto/sha3/tests/data/SHAKETestVectors.txt
+++ /dev/null
@@ -1,770 +0,0 @@
-# Test vectors for FIPS 202 - SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions
-#
-# Downloaded 6th August, 2015 from http://csrc.nist.gov/groups/ST/toolkit/examples.html#aHashing
-
-SHAKE-128 sample of 0-bit message
-
-Msg as bit string
-    #(empty message)
-
-Output val is
-    7F 9C 2B A4 E8 8F 82 7D 61 60 45 50 76 05 85 3E
-    D7 3B 80 93 F6 EF BC 88 EB 1A 6E AC FA 66 EF 26
-    3C B1 EE A9 88 00 4B 93 10 3C FB 0A EE FD 2A 68
-    6E 01 FA 4A 58 E8 A3 63 9C A8 A1 E3 F9 AE 57 E2
-    35 B8 CC 87 3C 23 DC 62 B8 D2 60 16 9A FA 2F 75
-    AB 91 6A 58 D9 74 91 88 35 D2 5E 6A 43 50 85 B2
-    BA DF D6 DF AA C3 59 A5 EF BB 7B CC 4B 59 D5 38
-    DF 9A 04 30 2E 10 C8 BC 1C BF 1A 0B 3A 51 20 EA
-    17 CD A7 CF AD 76 5F 56 23 47 4D 36 8C CC A8 AF
-    00 07 CD 9F 5E 4C 84 9F 16 7A 58 0B 14 AA BD EF
-    AE E7 EE F4 7C B0 FC A9 76 7B E1 FD A6 94 19 DF
-    B9 27 E9 DF 07 34 8B 19 66 91 AB AE B5 80 B3 2D
-    EF 58 53 8B 8D 23 F8 77 32 EA 63 B0 2B 4F A0 F4
-    87 33 60 E2 84 19 28 CD 60 DD 4C EE 8C C0 D4 C9
-    22 A9 61 88 D0 32 67 5C 8A C8 50 93 3C 7A FF 15
-    33 B9 4C 83 4A DB B6 9C 61 15 BA D4 69 2D 86 19
-    F9 0B 0C DF 8A 7B 9C 26 40 29 AC 18 5B 70 B8 3F
-    28 01 F2 F4 B3 F7 0C 59 3E A3 AE EB 61 3A 7F 1B
-    1D E3 3F D7 50 81 F5 92 30 5F 2E 45 26 ED C0 96
-    31 B1 09 58 F4 64 D8 89 F3 1B A0 10 25 0F DA 7F
-    13 68 EC 29 67 FC 84 EF 2A E9 AF F2 68 E0 B1 70
-    0A FF C6 82 0B 52 3A 3D 91 71 35 F2 DF F2 EE 06
-    BF E7 2B 31 24 72 1D 4A 26 C0 4E 53 A7 5E 30 E7
-    3A 7A 9C 4A 95 D9 1C 55 D4 95 E9 F5 1D D0 B5 E9
-    D8 3C 6D 5E 8C E8 03 AA 62 B8 D6 54 DB 53 D0 9B
-    8D CF F2 73 CD FE B5 73 FA D8 BC D4 55 78 BE C2
-    E7 70 D0 1E FD E8 6E 72 1A 3F 7C 6C CE 27 5D AB
-    E6 E2 14 3F 1A F1 8D A7 EF DD C4 C7 B7 0B 5E 34
-    5D B9 3C C9 36 BE A3 23 49 1C CB 38 A3 88 F5 46
-    A9 FF 00 DD 4E 13 00 B9 B2 15 3D 20 41 D2 05 B4
-    43 E4 1B 45 A6 53 F2 A5 C4 49 2C 1A DD 54 45 12
-    DD A2 52 98 33 46 2B 71 A4 1A 45 BE 97 29 0B 6F
-
-SHAKE-128 sample of 5-bit message
-
-Msg as bit string
-    1 1 0 0 1
-
-Output val is
-    2E 0A BF BA 83 E6 72 0B FB C2 25 FF 6B 7A B9 FF
-    CE 58 BA 02 7E E3 D8 98 76 4F EF 28 7D DE CC CA
-    3E 6E 59 98 41 1E 7D DB 32 F6 75 38 F5 00 B1 8C
-    8C 97 C4 52 C3 70 EA 2C F0 AF CA 3E 05 DE 7E 4D
-    E2 7F A4 41 A9 CB 34 FD 17 C9 78 B4 2D 5B 7E 7F
-    9A B1 8F FE FF C3 C5 AC 2F 3A 45 5E EB FD C7 6C
-    EA EB 0A 2C CA 22 EE F6 E6 37 F4 CA BE 5C 51 DE
-    D2 E3 FA D8 B9 52 70 A3 21 84 56 64 F1 07 D1 64
-    96 BB 7A BF BE 75 04 B6 ED E2 E8 9E 4B 99 6F B5
-    8E FD C4 18 1F 91 63 38 1C BE 7B C0 06 A7 A2 05
-    98 9C 52 6C D1 BD 68 98 36 93 B4 BD C5 37 28 B2
-    41 C1 CF F4 2B B6 11 50 2C 35 20 5C AB B2 88 75
-    56 55 D6 20 C6 79 94 F0 64 51 18 7F 6F D1 7E 04
-    66 82 BA 12 86 06 3F F8 8F E2 50 8D 1F CA F9 03
-    5A 12 31 AD 41 50 A9 C9 B2 4C 9B 2D 66 B2 AD 1B
-    DE 0B D0 BB CB 8B E0 5B 83 52 29 EF 79 19 73 73
-    23 42 44 01 E1 D8 37 B6 6E B4 E6 30 FF 1D E7 0C
-    B3 17 C2 BA CB 08 00 1D 34 77 B7 A7 0A 57 6D 20
-    86 90 33 58 9D 85 A0 1D DB 2B 66 46 C0 43 B5 9F
-    C0 11 31 1D A6 66 FA 5A D1 D6 38 7F A9 BC 40 15
-    A3 8A 51 D1 DA 1E A6 1D 64 8D C8 E3 9A 88 B9 D6
-    22 BD E2 07 FD AB C6 F2 82 7A 88 0C 33 0B BF 6D
-    F7 33 77 4B 65 3E 57 30 5D 78 DC E1 12 F1 0A 2C
-    71 F4 CD AD 92 ED 11 3E 1C EA 63 B9 19 25 ED 28
-    19 1E 6D BB B5 AA 5A 2A FD A5 1F C0 5A 3A F5 25
-    8B 87 66 52 43 55 0F 28 94 8A E2 B8 BE B6 BC 9C
-    77 0B 35 F0 67 EA A6 41 EF E6 5B 1A 44 90 9D 1B
-    14 9F 97 EE A6 01 39 1C 60 9E C8 1D 19 30 F5 7C
-    18 A4 E0 FA B4 91 D1 CA DF D5 04 83 44 9E DC 0F
-    07 FF B2 4D 2C 6F 9A 9A 3B FF 39 AE 3D 57 F5 60
-    65 4D 7D 75 C9 08 AB E6 25 64 75 3E AC 39 D7 50
-    3D A6 D3 7C 2E 32 E1 AF 3B 8A EC 8A E3 06 9C D9
-
-SHAKE-128 sample of 30-bit message
-
-Msg as bit string
-    1 1 0 0 1 0 1 0 0 0 0 1 1 0 1 0 1 1 0 1 1 1 1 0 1 0 0 1 1 0
-
-Output val is
-    6D 5D 39 C5 5F 3C CA 56 7F EA F4 22 DC 64 BA 17
-    40 1D 07 75 6D 78 B0 FA 3D 54 6D 66 AF C2 76 71
-    E0 01 06 85 FC 69 A7 EC 3C 53 67 B8 FA 5F DA 39
-    D5 7C E5 3F 15 3F A4 03 1D 27 72 06 77 0A EC 6B
-    2D DF 16 AE FA B6 69 11 0D 6E 4A 29 6A 14 FB 14
-    86 B0 84 6B 69 05 43 E4 05 7F 7F 42 AA 8C 0E 6A
-    5A 56 B6 0B 68 8D 55 A1 96 DF 6F 39 76 E3 06 88
-    CB B6 AF D4 85 25 D7 64 90 35 7F 3F D8 97 BA FC
-    87 36 D9 07 B9 BA C8 16 59 1F C2 4E 79 36 0B E3
-    A7 FF A6 29 82 C4 5A BB 0E 58 4C 07 EC 93 A1 95
-    30 50 9D 9F 81 62 15 D7 27 7B B9 99 43 7C 82 14
-    50 F0 75 92 81 CD 8E 16 A3 48 3E 3C C7 52 09 1B
-    7A AE 92 90 9D 2F 50 1E F7 DC E9 89 75 98 91 B3
-    37 7C EA B4 93 FF E4 96 01 0A 0C 7E 51 95 99 94
-    F5 6F 56 5E 63 3A F6 09 3A C6 E1 E0 F0 04 88 71
-    EC 47 78 F4 8E F8 BD 5B CB 80 EA 7D F9 FF 47 11
-    C8 1E 24 C0 22 1C 2A D9 74 4F BA 79 35 EA EC A1
-    14 22 4F D1 08 EF C5 AC 74 C6 62 52 08 92 75 B4
-    27 76 73 70 8C 4A F9 2F 88 13 B1 93 59 9F D6 4B
-    D7 48 4F 2E 5E C3 69 E3 64 64 99 76 8E 58 1D D0
-    53 AA 48 14 D8 BF 1A CF F5 FD 77 45 19 A7 49 BE
-    66 75 47 41 EB C5 36 22 12 A9 FE A8 A8 14 E9 E0
-    10 BC 27 20 B3 B7 D9 4F AB 74 BC 7F 92 3E 10 72
-    B8 A5 DD DD A8 3B A0 15 7D 8C BA 55 C1 92 DF 69
-    65 CB 7D BA 46 A3 34 0D F8 C3 FA 89 C7 C4 DB 53
-    9D 38 DC 40 6F 1D 2C F5 4E 59 05 58 0B 44 04 BF
-    D7 B3 71 95 61 C5 A5 9D 5D FD B1 BF 93 DF 13 82
-    52 25 ED CC E0 FA 7D 87 EF CD 23 9F EB 49 FC 9E
-    2D E9 D8 28 FE EB 1F 2C F5 79 B9 5D D0 50 AB 2C
-    A4 71 05 A8 D3 0F 3F D2 A1 15 4C 15 F8 7F B3 7B
-    2C 71 56 BD 7F 3C F2 B7 45 C9 12 A4 0B C1 B5 59
-    B6 56 E3 E9 03 CC 57 33 E8 6B A1 5D FE F7 06 78
-
-SHAKE-128 sample of 1600-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-
-Output val is
-    13 1A B8 D2 B5 94 94 6B 9C 81 33 3F 9B B6 E0 CE
-    75 C3 B9 31 04 FA 34 69 D3 91 74 57 38 5D A0 37
-    CF 23 2E F7 16 4A 6D 1E B4 48 C8 90 81 86 AD 85
-    2D 3F 85 A5 CF 28 DA 1A B6 FE 34 38 17 19 78 46
-    7F 1C 05 D5 8C 7E F3 8C 28 4C 41 F6 C2 22 1A 76
-    F1 2A B1 C0 40 82 66 02 50 80 22 94 FB 87 18 02
-    13 FD EF 5B 0E CB 7D F5 0C A1 F8 55 5B E1 4D 32
-    E1 0F 6E DC DE 89 2C 09 42 4B 29 F5 97 AF C2 70
-    C9 04 55 6B FC B4 7A 7D 40 77 8D 39 09 23 64 2B
-    3C BD 05 79 E6 09 08 D5 A0 00 C1 D0 8B 98 EF 93
-    3F 80 64 45 BF 87 F8 B0 09 BA 9E 94 F7 26 61 22
-    ED 7A C2 4E 5E 26 6C 42 A8 2F A1 BB EF B7 B8 DB
-    00 66 E1 6A 85 E0 49 3F 07 DF 48 09 AE C0 84 A5
-    93 74 8A C3 DD E5 A6 D7 AA E1 E8 B6 E5 35 2B 2D
-    71 EF BB 47 D4 CA EE D5 E6 D6 33 80 5D 2D 32 3E
-    6F D8 1B 46 84 B9 3A 26 77 D4 5E 74 21 C2 C6 AE
-    A2 59 B8 55 A6 98 FD 7D 13 47 7A 1F E5 3E 5A 4A
-    61 97 DB EC 5C E9 5F 50 5B 52 0B CD 95 70 C4 A8
-    26 5A 7E 01 F8 9C 0C 00 2C 59 BF EC 6C D4 A5 C1
-    09 25 89 53 EE 5E E7 0C D5 77 EE 21 7A F2 1F A7
-    01 78 F0 94 6C 9B F6 CA 87 51 79 34 79 F6 B5 37
-    73 7E 40 B6 ED 28 51 1D 8A 2D 7E 73 EB 75 F8 DA
-    AC 91 2F F9 06 E0 AB 95 5B 08 3B AC 45 A8 E5 E9
-    B7 44 C8 50 6F 37 E9 B4 E7 49 A1 84 B3 0F 43 EB
-    18 8D 85 5F 1B 70 D7 1F F3 E5 0C 53 7A C1 B0 F8
-    97 4F 0F E1 A6 AD 29 5B A4 2F 6A EC 74 D1 23 A7
-    AB ED DE 6E 2C 07 11 CA B3 6B E5 AC B1 A5 A1 1A
-    4B 1D B0 8B A6 98 2E FC CD 71 69 29 A7 74 1C FC
-    63 AA 44 35 E0 B6 9A 90 63 E8 80 79 5C 3D C5 EF
-    32 72 E1 1C 49 7A 91 AC F6 99 FE FE E2 06 22 7A
-    44 C9 FB 35 9F D5 6A C0 A9 A7 5A 74 3C FF 68 62
-    F1 7D 72 59 AB 07 52 16 C0 69 95 11 64 3B 64 39
-
-SHAKE-128 sample of 1605-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0
-
-Output val is
-    4A C3 8E BD 16 78 B4 A4 52 79 2C 56 73 F9 77 7D
-    36 B5 54 51 AA AE 24 24 92 49 42 D3 18 A2 F6 F5
-    1B BC 83 7D CC 70 22 C5 40 3B 69 D2 9A C9 9A 74
-    5F 06 D0 6F 2A 41 B0 CC 24 3C D2 70 FA 44 D4 30
-    65 AF 00 D2 AD 35 8B D5 A5 D0 6D 33 1B C2 30 CD
-    8D DA 46 55 62 8F 91 02 71 1A DA FB 76 36 C1 60
-    B2 D2 5E C6 23 5A 2F E0 F3 73 94 D8 7F C5 FF D7
-    DB F1 99 3E 55 8A EB EA 6C 61 E9 07 18 8C 61 F5
-    FC DE 27 8E 26 4F 95 8F FD 7B 33 82 DC 10 13 9B
-    62 5E 12 41 AB 5B BC 2A 1F BC AC 31 A3 35 CF C7
-    B2 0E 42 77 12 24 6C BB 55 23 22 59 A7 EF 16 02
-    BD 56 F6 56 7D 66 94 2D 4A 71 49 F4 22 22 10 B0
-    74 EA 54 15 4B 38 E8 FD FA 0D CF 4F A3 EC D2 15
-    4E 83 18 A6 57 8B 53 5D BC FC 21 7A 3C AB 52 53
-    29 65 84 6F 89 78 14 57 02 55 63 E2 DC 15 CC 3A
-    F9 02 BA 2A D2 80 FF BB BF A4 C5 2B 60 FA 41 BA
-    C2 1F 4A B2 35 36 26 81 19 FC 98 CD 98 2D A5 CD
-    5D A2 1E 1B 56 92 D4 71 05 DE 9F 1E 01 32 C6 FE
-    31 5D 67 FA 46 49 97 C2 AB 55 33 C7 9F 98 E6 E6
-    4F F8 08 02 A7 FE 96 CA 04 A8 1F 88 55 27 37 0A
-    22 06 B1 0B 39 36 DD 81 B8 24 63 53 F4 CD 90 51
-    10 89 26 8D 74 4F 21 0A C6 89 D4 9D 28 75 05 4A
-    72 7B 60 4D 13 D2 69 B3 71 90 D4 27 C7 D1 5C CC
-    DC D7 87 0E 0B 8A DB EB 97 71 11 A9 BC F7 78 1A
-    16 13 56 A5 94 1C 79 99 07 EF 9D 3B 1A 44 1F 09
-    51 5F 28 31 C4 FA FD E3 DC 7C 1E 9B 5A A5 7D 3E
-    83 CD 67 34 DA 3D 8B 9E F3 FC 44 88 05 EA 29 C9
-    9C BA 6B 35 2B CA BE 2F D9 70 AE 95 80 D2 BF 25
-    15 2B 96 0E 6B 80 6D 87 D7 D0 60 8B 24 7F 61 08
-    9E 29 86 92 C2 7F 19 C5 2D 03 EB E3 95 A3 68 06
-    AD 54 0B EC 2D 04 6C 18 E3 55 FA F8 31 3D 2E F8
-    99 5E E6 AA E4 25 68 F3 14 93 3E 3A 21 E5 BE 40
-
-SHAKE-128 sample of 1630-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1
-
-Output val is
-    89 84 6D C7 76 AC 0F 01 45 72 EA 79 F5 60 77 34
-    51 00 29 38 24 8E 68 82 56 9A C3 2A EA B1 91 FC
-    AC DE 68 EB 07 55 75 39 C4 84 5F B4 44 10 8E 6E
-    05 45 E7 31 FC CA 2D 4F 67 A3 BF D4 1C FF 3E AF
-    35 EE FB 53 44 11 77 96 5B B5 16 95 0C F5 DC B2
-    AA FC BB C6 30 0E 8E EF D9 BC D0 E5 F3 2D 1A 4E
-    87 2E 0F 1D BD 8F 8E 00 CB B8 78 69 8C 58 83 E3
-    CA 18 4B 94 90 38 9E 46 00 2C 08 A0 B1 6B 05 A3
-    6B 2C B5 A1 CA E0 8E 11 AD 97 2F D2 4A F7 01 01
-    CE 47 46 C8 4F 16 71 87 7F 0D F6 C4 15 D1 67 0F
-    F4 0B 8D DE DD 89 CC 3E 65 6D B9 05 80 49 D6 09
-    B6 78 4C C9 D0 5E 60 CC 6A C9 C8 19 49 93 BA 29
-    15 8F D4 DB 8C F2 25 E9 57 4F 18 A7 7F 66 EC 10
-    52 BF 17 99 3B DA 20 6A 17 73 7D 78 5B D4 C1 8C
-    EE 4C 76 AA 57 35 A5 22 3F 3C 55 E7 9D AE C1 3D
-    4B F6 0F 15 62 E0 AD 0F A3 B5 58 EC CF A8 AB 3E
-    EF 61 47 4D 57 6E 8C AF 4C 11 E4 DE 5C CB 36 D7
-    DF 7D 89 2C 1F CA 20 17 BE 8B BD A5 A4 71 95 44
-    8C C6 7A 07 8E 62 8A 2E F7 63 FF E1 DC 9D 9D 6F
-    F7 8E 68 96 1C 33 FF D9 00 0C 11 DE E7 F7 40 8D
-    8D A5 C6 05 B0 B4 D5 6B B5 5E 93 64 C7 7B FA D9
-    C8 19 1E D6 E1 FE 7B 7A 93 7C 6D 07 09 5F E5 EA
-    91 A7 00 B4 BD FC 17 B4 28 D0 36 92 2A A8 AB 5E
-    2C D5 85 84 6F B8 1F C6 93 B8 D5 9B F8 5C 74 BC
-    70 0C D2 BC 3E 6A AB 43 7D 93 D8 A3 0F 1C F6 92
-    EF EF 43 60 20 28 E0 CE 57 42 EB 3F 4F 4D 5B 02
-    91 58 DD 68 96 AC B5 E3 A7 F6 84 D9 AA 89 14 E7
-    09 74 B2 23 A6 FE C3 8D 76 C7 47 3E 86 E4 B9 B3
-    2C 62 1E 20 15 C5 5E 94 7D D0 16 C6 75 C8 23 68
-    CE 26 FB 45 6A 5B 65 88 1A F5 13 BF DC 88 68 7C
-    63 81 67 6A BB D2 D9 10 4E D2 3A 9E 89 31 02 46
-    B0 26 CE DD 57 59 5B 1A B6 FE 88 A7 84 BE 0C 06
-
-SHAKE-256 sample of 0-bit message
-
-Msg as bit string
-    #(empty message)
-
-Output val is
-    46 B9 DD 2B 0B A8 8D 13 23 3B 3F EB 74 3E EB 24
-    3F CD 52 EA 62 B8 1B 82 B5 0C 27 64 6E D5 76 2F
-    D7 5D C4 DD D8 C0 F2 00 CB 05 01 9D 67 B5 92 F6
-    FC 82 1C 49 47 9A B4 86 40 29 2E AC B3 B7 C4 BE
-    14 1E 96 61 6F B1 39 57 69 2C C7 ED D0 B4 5A E3
-    DC 07 22 3C 8E 92 93 7B EF 84 BC 0E AB 86 28 53
-    34 9E C7 55 46 F5 8F B7 C2 77 5C 38 46 2C 50 10
-    D8 46 C1 85 C1 51 11 E5 95 52 2A 6B CD 16 CF 86
-    F3 D1 22 10 9E 3B 1F DD 94 3B 6A EC 46 8A 2D 62
-    1A 7C 06 C6 A9 57 C6 2B 54 DA FC 3B E8 75 67 D6
-    77 23 13 95 F6 14 72 93 B6 8C EA B7 A9 E0 C5 8D
-    86 4E 8E FD E4 E1 B9 A4 6C BE 85 47 13 67 2F 5C
-    AA AE 31 4E D9 08 3D AB 4B 09 9F 8E 30 0F 01 B8
-    65 0F 1F 4B 1D 8F CF 3F 3C B5 3F B8 E9 EB 2E A2
-    03 BD C9 70 F5 0A E5 54 28 A9 1F 7F 53 AC 26 6B
-    28 41 9C 37 78 A1 5F D2 48 D3 39 ED E7 85 FB 7F
-    5A 1A AA 96 D3 13 EA CC 89 09 36 C1 73 CD CD 0F
-    AB 88 2C 45 75 5F EB 3A ED 96 D4 77 FF 96 39 0B
-    F9 A6 6D 13 68 B2 08 E2 1F 7C 10 D0 4A 3D BD 4E
-    36 06 33 E5 DB 4B 60 26 01 C1 4C EA 73 7D B3 DC
-    F7 22 63 2C C7 78 51 CB DD E2 AA F0 A3 3A 07 B3
-    73 44 5D F4 90 CC 8F C1 E4 16 0F F1 18 37 8F 11
-    F0 47 7D E0 55 A8 1A 9E DA 57 A4 A2 CF B0 C8 39
-    29 D3 10 91 2F 72 9E C6 CF A3 6C 6A C6 A7 58 37
-    14 30 45 D7 91 CC 85 EF F5 B2 19 32 F2 38 61 BC
-    F2 3A 52 B5 DA 67 EA F7 BA AE 0F 5F B1 36 9D B7
-    8F 3A C4 5F 8C 4A C5 67 1D 85 73 5C DD DB 09 D2
-    B1 E3 4A 1F C0 66 FF 4A 16 2C B2 63 D6 54 12 74
-    AE 2F CC 86 5F 61 8A BE 27 C1 24 CD 8B 07 4C CD
-    51 63 01 B9 18 75 82 4D 09 95 8F 34 1E F2 74 BD
-    AB 0B AE 31 63 39 89 43 04 E3 58 77 B0 C2 8A 9B
-    1F D1 66 C7 96 B9 CC 25 8A 06 4A 8F 57 E2 7F 2A
-
-SHAKE-256 sample of 5-bit message
-
-Msg as bit string
-    1 1 0 0 1
-
-Output val is
-    48 A5 C1 1A BA EE FF 09 2F 36 46 EF 0D 6B 3D 3F
-    F7 6C 2F 55 F9 C7 32 AC 64 70 C0 37 64 00 82 12
-    E2 1B 14 67 77 8B 18 19 89 F8 88 58 21 1B 45 DF
-    87 99 CF 96 1F 80 0D FA C9 9E 64 40 39 E2 97 9A
-    40 16 F5 45 6F F4 21 C5 B3 85 DA 2B 85 5D A7 E3
-    1C 8C 2E 8E 4B A4 1E B4 09 5C B9 99 D9 75 9C B4
-    03 58 DA 85 62 A2 E6 13 49 E0 5A 2E 13 F1 B7 4E
-    C9 E6 9F 5B 42 6D C7 41 38 FF CD C5 71 C3 2B 39
-    B9 F5 55 63 E1 A9 9D C4 22 C3 06 02 6D 6A 0F 9D
-    E8 51 62 B3 86 79 4C A0 68 8B 76 4B 3D 32 20 0C
-    C4 59 74 97 32 A0 F3 A3 41 C0 EF C9 6A 22 C6 3B
-    AD 7D 96 CC 9B A4 76 8C 6F CF A1 F2 00 10 7C F9
-    FA E5 C0 D7 54 95 8C 5A 75 6B 37 6A 3B E6 9F 88
-    07 4F 20 0E 9E 95 A8 CA 5B CF 96 99 98 DB 1D C3
-    7D 0D 3D 91 6F 6C AA B3 F0 37 82 C9 C4 4A 2E 14
-    E8 07 86 BE CE 45 87 B9 EF 82 CB F4 54 E0 E3 4B
-    D1 75 AE 57 D3 6A F4 E7 26 B2 21 33 2C ED 36 C8
-    CE 2E 06 20 3C 65 6A E8 DA 03 7D 08 E7 16 0B 48
-    0C 1A 85 16 BF 06 DD 97 BF 4A A4 C0 24 93 10 DC
-    0B 06 5D C6 39 57 63 55 38 4D 16 5C 6A 50 9B 12
-    F7 BB D1 E1 5B 22 BC E0 2F A0 48 DD FA AC F7 41
-    5F 49 B6 32 4C 1D 06 7B 52 64 E1 12 5F 7F 75 42
-    7F 31 2B D9 34 6E B4 E4 00 B1 F7 CB 31 28 8C 9E
-    3F 73 5E CA 9C ED 0D B8 88 E2 E2 F4 02 24 3B D6
-    46 18 A2 3E 10 F9 C2 29 39 74 40 54 2D 0A B1 B2
-    E1 0D AC C5 C9 5E 59 7F 2C 7E A3 84 38 10 5F 97
-    80 3D BB 03 FC C0 FD 41 6B 09 05 A4 1D 18 4D EB
-    23 89 05 77 58 91 F9 35 01 FB 41 76 A3 BD 6C 46
-    44 61 D3 6E E8 B0 08 AA BD 9E 26 A3 40 55 E8 0C
-    8C 81 3E EB A0 7F 72 8A B3 2B 15 60 5A D1 61 A0
-    66 9F 6F CE 5C 55 09 FB B6 AF D2 4A EA CC 5F A4
-    A5 15 23 E6 B1 73 24 6E D4 BF A5 21 D7 4F C6 BB
-
-SHAKE-256 sample of 30-bit message
-
-Msg as bit string
-    1 1 0 0 1 0 1 0 0 0 0 1 1 0 1 0 1 1 0 1 1 1 1 0 1 0 0 1 1 0
-
-Output val is
-    46 5D 08 1D FF 87 5E 39 62 00 E4 48 1A 3E 9D CD
-    88 D0 79 AA 6D 66 22 6C B6 BA 45 41 07 CB 81 A7
-    84 1A B0 29 60 DE 27 9C CB E3 4B 42 C3 65 85 AD
-    86 96 4D B0 DB 52 B6 E7 B4 36 9E CE 8F 72 48 58
-    9B A7 8A B1 82 8F FC 33 5C B1 23 97 11 9B FD 2B
-    87 EB 78 98 AE B9 56 B6 F2 3D DF 0B D4 00 43 86
-    A8 E5 26 55 4E F4 E4 83 FA CE E3 0D D3 2E 20 4F
-    FF 8C 36 BB D6 02 A5 76 D1 39 08 9C 75 A8 05 02
-    66 FC BF 72 1E 44 43 DE 46 45 83 29 22 EB 8A AE
-    39 D1 F5 72 84 53 64 81 7B 00 33 54 38 99 94 00
-    23 F2 E9 65 A6 0A 80 EB 22 1E B1 9D C5 7B 12 12
-    91 56 4C 6F 69 35 83 B3 AC 7C 6F 27 2F 4F 67 A1
-    9A 76 78 D4 23 4B 0B F4 A2 EB C0 8A A2 35 B9 78
-    8D B7 87 16 1F 66 17 02 28 65 C0 EF 9A A5 33 80
-    2D 13 6C DB C7 AE BA 53 2A CF 1B E1 83 B0 29 5A
-    B0 E3 3A 2E F6 9B E3 56 DA AF 30 96 87 15 3E 2F
-    99 A1 24 36 09 D6 03 12 6A 8C 82 3E 88 43 E4 59
-    BF C7 2B 30 69 1C DC C3 DD B2 7C F0 28 AF D5 1E
-    44 37 EE 3B 71 C0 C1 EC 87 A9 34 36 F0 C2 47 B7
-    E8 C5 0C E9 68 25 C9 70 29 99 7A 74 C3 18 AF AC
-    AA 18 A0 18 0B C7 F2 F0 F1 C5 E7 EF 1A 2D 18 3A
-    C7 EE 7E 49 15 C3 B6 8C 30 97 8A B6 C4 28 19 34
-    41 DF 47 05 B7 22 CE 25 A0 8A 1F AD CA 0E EF 1F
-    AF E8 3A DF 13 02 1D 52 0D E5 C8 27 FF 9A 97 B7
-    55 46 19 3A 9B 92 3F 05 90 38 5D C4 BF F7 C4 9D
-    49 15 B5 A3 65 DB 4C 84 DD CB 18 5D E8 F9 EE B3
-    34 96 5A 42 F1 38 1C 8B AD C2 2B A1 F8 EE 4C 0E
-    4D AA F7 A8 8E 7F 42 DD B8 14 8F 3B F8 D3 B8 D7
-    4F 09 81 55 A3 7C B4 CB 27 87 6B 85 DA 60 2E 5C
-    78 9C 10 E0 3B E7 34 07 BA B8 C4 92 13 F8 C7 4E
-    12 66 CE 9B 11 28 6E 67 4C A9 C1 0C 9C 99 55 04
-    9A 66 E9 05 1D 9A 2B 1F C9 AF E2 67 98 E9 CE C6
-
-SHAKE-256 sample of 1600-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-
-Output val is
-    CD 8A 92 0E D1 41 AA 04 07 A2 2D 59 28 86 52 E9
-    D9 F1 A7 EE 0C 1E 7C 1C A6 99 42 4D A8 4A 90 4D
-    2D 70 0C AA E7 39 6E CE 96 60 44 40 57 7D A4 F3
-    AA 22 AE B8 85 7F 96 1C 4C D8 E0 6F 0A E6 61 0B
-    10 48 A7 F6 4E 10 74 CD 62 9E 85 AD 75 66 04 8E
-    FC 4F B5 00 B4 86 A3 30 9A 8F 26 72 4C 0E D6 28
-    00 1A 10 99 42 24 68 DE 72 6F 10 61 D9 9E B9 E9
-    36 04 D5 AA 74 67 D4 B1 BD 64 84 58 2A 38 43 17
-    D7 F4 7D 75 0B 8F 54 99 51 2B B8 5A 22 6C 42 43
-    55 6E 69 6F 6B D0 72 C5 AA 2D 9B 69 73 02 44 B5
-    68 53 D1 69 70 AD 81 7E 21 3E 47 06 18 17 80 01
-    C9 FB 56 C5 4F EF A5 FE E6 7D 2D A5 24 BB 3B 0B
-    61 EF 0E 91 14 A9 2C DB B6 CC CB 98 61 5C FE 76
-    E3 51 0D D8 8D 1C C2 8F F9 92 87 51 2F 24 BF AF
-    A1 A7 68 77 B6 F3 71 98 E3 A6 41 C6 8A 7C 42 D4
-    5F A7 AC C1 0D AE 5F 3C EF B7 B7 35 F1 2D 4E 58
-    9F 7A 45 6E 78 C0 F5 E4 C4 47 1F FF A5 E4 FA 05
-    14 AE 97 4D 8C 26 48 51 3B 5D B4 94 CE A8 47 15
-    6D 27 7A D0 E1 41 C2 4C 78 39 06 4C D0 88 51 BC
-    2E 7C A1 09 FD 4E 25 1C 35 BB 0A 04 FB 05 B3 64
-    FF 8C 4D 8B 59 BC 30 3E 25 32 8C 09 A8 82 E9 52
-    51 8E 1A 8A E0 FF 26 5D 61 C4 65 89 69 73 D7 49
-    04 99 DC 63 9F B8 50 2B 39 45 67 91 B1 B6 EC 5B
-    CC 5D 9A C3 6A 6D F6 22 A0 70 D4 3F ED 78 1F 5F
-    14 9F 7B 62 67 5E 7D 1A 4D 6D EC 48 C1 C7 16 45
-    86 EA E0 6A 51 20 8C 0B 79 12 44 D3 07 72 65 05
-    C3 AD 4B 26 B6 82 23 77 25 7A A1 52 03 75 60 A7
-    39 71 4A 3C A7 9B D6 05 54 7C 9B 78 DD 1F 59 6F
-    2D 4F 17 91 BC 68 9A 0E 9B 79 9A 37 33 9C 04 27
-    57 33 74 01 43 EF 5D 2B 58 B9 6A 36 3D 4E 08 07
-    6A 1A 9D 78 46 43 6E 4D CA 57 28 B6 F7 60 EE F0
-    CA 92 BF 0B E5 61 5E 96 95 9D 76 71 97 A0 BE EB
-
-SHAKE-256 sample of 1605-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0
-
-Output val is
-    98 D0 93 B0 67 47 57 60 12 4F FB 92 04 A5 B3 27
-    C6 BB 05 C5 4F F2 34 F0 B4 3F AC 72 40 41 51 66
-    A8 C7 05 EA 0D 73 9F 08 08 B0 65 76 D9 96 66 2C
-    1F 37 66 94 D9 8F 51 57 19 B6 64 07 72 0D CF 78
-    1C 51 CD 56 EF 8B 61 0C 66 8D DC 1A C1 C2 C4 29
-    EA 4D 6F 27 4A A7 A7 73 BF 8B 0C AB 30 6F 1E EE
-    2A 17 1B 91 33 4E A0 FA CD 2A AC 1F 51 D4 D5 EB
-    0E 63 A4 E6 75 4E CA FE EC 24 6B 7A AF 58 D0 E0
-    A9 74 C7 FF 40 58 BD BD ED B3 3E D0 4B 0F A4 5D
-    70 C7 C8 4F 3D A1 3E 4F 7D 1B ED DB 53 4D 37 E5
-    AB DF B2 9F 2B 44 C4 FB 0D 6C CA B8 31 D9 0B A4
-    6A 00 53 06 62 F9 07 DE DD 47 9E 9B 54 28 E5 E2
-    DB 80 40 B0 E2 B1 F1 74 CE 34 7F 32 A0 6A 5A C2
-    2B 19 AA FE 92 7B 88 78 D0 C8 10 3A 4D 2F 19 E3
-    23 36 C6 4C FA DC 1B 9A CB 39 78 A8 29 85 71 DC
-    D8 9C 36 A6 56 92 81 6D 0C 61 CE 0E D1 79 42 36
-    70 17 BD 40 F5 9D FB AE 34 63 58 27 92 0A FE 7A
-    27 BF 56 70 09 A1 38 40 3F 06 B6 E4 DE 94 DA 07
-    7D B4 97 73 C2 35 46 61 19 42 6F 79 88 8D 3A 81
-    B4 07 DF EB A8 7E 01 CD 48 F9 0E 01 B6 F9 02 43
-    C4 01 25 DE 47 E8 C8 F3 E6 EA 33 88 CB FE EB 36
-    54 1E F2 3D 2C 83 48 45 8E A2 8C AA 50 66 F4 98
-    37 76 F0 CB 2F DC 66 04 9C F8 8A C8 EA E5 12 12
-    AA CE 86 7B EA 4C 3C AE E4 4F 14 7A 9B F9 9D 04
-    87 4E 87 22 D0 3D 3F 5F F6 EF 3B EB E7 64 2F E4
-    91 6C 5F 10 FF 3F D6 13 87 D5 D9 1B CD 32 F9 E8
-    E4 59 3D CA AD 23 EC CC 05 D2 FC 9B E2 C1 CD 63
-    0E A1 23 DC A9 CB 69 38 D6 0C DD ED C1 1E 1E 9B
-    C9 D2 68 A5 45 6B A9 CC FF 18 59 7C 5F F9 73 57
-    08 41 3B 9D 84 B9 F4 72 19 37 CC 65 95 71 27 97
-    53 2B 48 D6 F1 A2 D1 72 3B 07 D5 46 0B C1 39 16
-    D9 6E 88 18 07 13 AC 33 D2 C2 32 E3 5E 76 4E 04
-
-SHAKE-256 sample of 1630-bit message
-
-Msg as bit string
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1
-    1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1 0 1 1 1 0 0 0 1
-
-Output val is
-    8A 83 25 07 9B 0F C3 26 5D 52 F5 98 55 CA FE 65
-    5D F4 38 AA 63 9F 6F EC 99 1F 24 94 33 0C E3 2F
-    A3 7F 7D B9 0F 69 66 D8 E4 A4 6E 50 C5 ED E5 7B
-    9B 8F 08 2A 96 62 7F 73 04 75 02 9A 61 92 29 D8
-    4F 43 2E D6 9F D0 59 23 4D 4D 7D D3 58 E8 39 3F
-    6A 36 A4 5C CF 04 1F 90 FC 0A 4E 58 02 D7 30 63
-    D3 65 31 33 6A 00 90 EC FE 1A 4D 4D 29 AA 82 4B
-    A4 2B 49 37 B4 BB 98 F4 F3 3A 0E 3B D8 B5 11 E6
-    95 28 D5 95 37 11 0D 75 21 FB 78 AC A0 18 DF 76
-    16 0F 54 A3 42 1B 84 14 92 64 ED 03 2F 6D CE 46
-    7A 73 1A 8E 34 04 8E 3A 46 E9 80 39 DF 3C 32 8D
-    EB FB E5 D1 BC 8B E7 FF 4E F8 91 7B 01 F0 B7 89
-    36 72 49 2D 6E E5 C7 1D F2 D0 53 1F 8B 68 47 64
-    BA 0A 2B 57 EC 6A 4F 60 BA 4F 36 FE 2D B0 E6 5A
-    D7 AA 5F 14 F3 EF 9F 34 A0 AB 5B C3 3D 48 87 33
-    BA 36 BF 4B 2B 4F CE 02 8E FF 8C 6C E0 3B 19 2C
-    F0 75 CC 9F 00 D2 9C 0E 06 C3 5C 44 89 D2 7F 07
-    FA 49 A9 1C A9 24 71 E3 4D AB 77 87 AE 24 A6 E0
-    F3 09 EF 0B A5 3F 7C 8B 29 92 52 0A 07 BE DD 50
-    9A 0B 6D BE A5 70 A5 96 0E D6 24 82 6D D8 EC D1
-    91 5C 87 32 7E 74 49 1C 40 5A 74 11 C1 2C 0D 44
-    97 51 26 89 BD 7F 5A DB ED B0 2C 6D 2E 68 47 4E
-    8B F3 1B 88 40 40 81 8F 4B CA 03 A4 52 17 EA C7
-    08 3A D3 A3 3C B8 47 7A 04 C9 E3 26 6A 13 34 77
-    DE 45 E7 18 30 A4 0E B0 D0 75 AF CC FC D9 DC 54
-    8D 0D 52 94 60 EA 7A C2 AD AC 72 2E 76 78 EF 59
-    7D D3 B4 95 BD 7D 1A 8F F3 94 48 BB AB 1D C6 A8
-    84 81 80 1C F5 A8 01 0E 87 3C 31 E4 79 A5 E3 DB
-    3D 4E 67 D1 D9 48 E6 7C C6 6F D7 5A 4A 19 C1 20
-    66 2E F5 59 77 BD DB AC 07 21 C8 0D 69 90 26 93
-    C8 3D 5E F7 BC 27 EF A3 93 AF 4C 43 9F C3 99 58
-    E0 E7 55 37 35 88 02 EF 08 53 B7 47 0B 0F 19 AC
-
diff --git a/crypto/sha3/tests/sha3_tests.rs b/crypto/sha3/tests/sha3_tests.rs
index 306d8816..0a3c686f 100644
--- a/crypto/sha3/tests/sha3_tests.rs
+++ b/crypto/sha3/tests/sha3_tests.rs
@@ -1,6 +1,7 @@
 #[cfg(test)]
 mod sha3_tests {
     use super::sha3_test_helpers::*;
+    use bouncycastle_core::errors::HashError;
     use bouncycastle_core::key_material;
     use bouncycastle_core::key_material::{
         KeyMaterial, KeyMaterial256, KeyMaterial512, KeyMaterialTrait, KeyType,
@@ -142,6 +143,28 @@ mod sha3_tests {
         assert_eq!(output, expected_output[..SHA3_224::OUTPUT_LEN - 1]);
     }
 
+    /// do_final_partial_bits() must validate num_partial_bits before shifting: 0 is equivalent to
+    /// do_final(), 8+ is rejected with InvalidLength rather than panicking (16+ used to overflow a shift).
+    #[test]
+    fn partial_bits_range_is_validated() {
+        for bad in [8usize, 9, 15, 16, 64, usize::MAX] {
+            let mut h = SHA3_256::new();
+            h.do_update(b"abc");
+            assert!(
+                matches!(h.do_final_partial_bits(0xFF, bad), Err(HashError::InvalidLength(_))),
+                "num_partial_bits={bad}"
+            );
+            let mut out = [0u8; 32];
+            assert!(matches!(
+                SHA3_256::new().do_final_partial_bits_out(0xFF, bad, &mut out),
+                Err(HashError::InvalidLength(_))
+            ));
+        }
+        let mut h = SHA3_256::new();
+        h.do_update(b"abc");
+        assert_eq!(h.do_final_partial_bits(0xFF, 0).unwrap(), SHA3_256::new().hash(b"abc"));
+    }
+
     #[test]
     fn test_do_final_out_truncation() {
         let expected_output =  b"\xFE\x51\xC5\xD7\x62\x48\xE1\xE9\xD3\x01\x29\x6A\xE8\xAB\x94\x69\xD2\x86\x34\xB4\xAD\x3E\x9E\x78\xC8\xB0\x9D\x47";
@@ -393,7 +416,7 @@ mod sha3_tests {
 
     #[test]
     fn run_kats() {
-        run_test_vectors(read_test_vectors("tests/data/SHA3TestVectors.txt"));
+        run_test_vectors(read_test_vectors("SHA3TestVectors.txt"));
     }
 
     #[test]
@@ -486,6 +509,34 @@ mod sha3_tests {
 pub(crate) mod sha3_test_helpers {
     use bouncycastle_hex as hex;
     use std::fs;
+    use std::path::Path;
+    use std::sync::Once;
+
+    // Test vectors are read from the bc-test-data repo (https://github.com/bcgit/bc-test-data),
+    // which must be cloned alongside this repo at "../bc-test-data" (same convention as the mldsa
+    // and mlkem crates). If it is not present the vector tests print a warning and pass vacuously.
+    const TEST_DATA_PATH_RELATIVE: &str = "../../../bc-test-data/crypto";
+    const TEST_DATA_PATH: &str = "../bc-test-data/crypto";
+
+    static TEST_DATA_CHECK: Once = Once::new();
+
+    /// Returns the contents of `filename` from bc-test-data, or `None` (after a one-time warning)
+    /// if the repo is not checked out.
+    fn get_test_data(filename: &str) -> Option<String> {
+        let dir =
+            [TEST_DATA_PATH_RELATIVE, TEST_DATA_PATH].into_iter().find(|d| Path::new(d).exists());
+        TEST_DATA_CHECK.call_once(|| match dir {
+            Some(d) => println!("bc-test-data found at: {d:?}"),
+            None => {
+                println!("WARNING: bc-test-data directory not found; vector tests will be skipped")
+            }
+        });
+        let dir = dir?;
+        Some(
+            fs::read_to_string(format!("{dir}/{filename}"))
+                .expect("failed to read test vector file"),
+        )
+    }
 
     const SAMPLE_OF: &str = " sample of ";
     const MSG_HEADER: &str = "Msg as bit string";
@@ -498,10 +549,14 @@ pub(crate) mod sha3_test_helpers {
         pub(crate) hash: Vec<u8>,
     }
 
-    pub(crate) fn read_test_vectors(path: &str) -> Vec<TestCase> {
+    /// Parses the named NIST FIPS 202 example-vector file from bc-test-data. Returns an empty list
+    /// (skipping the test) if bc-test-data is not available.
+    pub(crate) fn read_test_vectors(filename: &str) -> Vec<TestCase> {
         let mut test_vectors: Vec<TestCase> = vec![];
-        let string_content: Vec<String> =
-            fs::read_to_string(path).unwrap().lines().map(String::from).collect();
+        let Some(content) = get_test_data(filename) else {
+            return test_vectors;
+        };
+        let string_content: Vec<String> = content.lines().map(String::from).collect();
 
         let mut i = 0;
         while i < string_content.len() {
diff --git a/crypto/sha3/tests/shake_tests.rs b/crypto/sha3/tests/shake_tests.rs
index 260e6e1d..94799362 100644
--- a/crypto/sha3/tests/shake_tests.rs
+++ b/crypto/sha3/tests/shake_tests.rs
@@ -3,6 +3,7 @@ extern crate core;
 #[cfg(test)]
 mod shake_tests {
     use super::shake_test_helpers::*;
+    use bouncycastle_core::errors::HashError;
     use bouncycastle_core::key_material::{
         KeyMaterial, KeyMaterial256, KeyMaterial512, KeyMaterialTrait, KeyType,
     };
@@ -62,6 +63,77 @@ mod shake_tests {
         assert_eq!(out, 0x01);
     }
 
+    /// Regression: squeeze_partial_byte_final() as the *first* squeeze must apply the SHAKE "1111"
+    /// domain suffix (previously it bypassed it and returned raw Keccak output), and must return the
+    /// low `num_bits` bits of the next output byte (FIPS 202 B.1 bit ordering), zero-extended.
+    #[test]
+    fn partial_bit_output_as_first_squeeze_matches_full_output() {
+        let msg = b"abc";
+        for skip in [0usize, 1, 5] {
+            let mut shake = SHAKE256::new();
+            shake.absorb(msg).unwrap();
+            let full = shake.squeeze(skip + 1)[skip];
+            // pick a byte that is not all-ones/all-zeros so bit selection is actually tested
+            assert!(
+                full != 0x00 && full != 0xFF,
+                "test vector byte must be non-uniform: {full:#x}"
+            );
+
+            for n in 1..=7usize {
+                let mut shake = SHAKE256::new();
+                shake.absorb(msg).unwrap();
+                if skip > 0 {
+                    _ = shake.squeeze(skip);
+                }
+                let got = shake.squeeze_partial_byte_final(n).unwrap();
+                assert_eq!(got, full & ((1u8 << n) - 1), "skip={skip} n={n}");
+                assert_eq!(got >> n, 0, "high bits must be zero");
+            }
+        }
+    }
+
+    /// Regression: when the 4 trailing message bits plus the SHAKE "1111" suffix exactly fill a byte,
+    /// the sponge must still switch to squeezing, otherwise the first squeeze appended a second suffix.
+    /// Vector: NIST CAVP SHA3VS SHAKE128ShortMsg (bit-oriented), Len = 4, Msg = 08.
+    #[test]
+    fn absorb_last_partial_byte_four_bits() {
+        let mut shake = SHAKE128::new();
+        shake.absorb_last_partial_byte(0x08, 4).unwrap();
+        assert_eq!(
+            shake.squeeze(16),
+            bouncycastle_hex::decode("d40238024b040a954d9c2c89daf480e5").unwrap(),
+            "SHAKE128 of the 4-bit message 0001"
+        );
+    }
+
+    /// absorb_last_partial_byte() must validate num_partial_bits before shifting: 0 is allowed
+    /// (finalize with no partial byte), 8+ is rejected with InvalidLength rather than panicking.
+    #[test]
+    fn absorb_last_partial_byte_validates_range() {
+        for bad in [8usize, 9, 15, 16, 64, usize::MAX] {
+            let mut shake = SHAKE128::new();
+            shake.absorb(b"abc").unwrap();
+            assert!(
+                matches!(
+                    shake.absorb_last_partial_byte(0xFF, bad),
+                    Err(HashError::InvalidLength(_))
+                ),
+                "num_partial_bits={bad}"
+            );
+        }
+        let mut a = SHAKE128::new();
+        a.absorb(b"abc").unwrap();
+        a.absorb_last_partial_byte(0xFF, 0).unwrap();
+        assert_eq!(a.squeeze(32), SHAKE128::new().hash_xof(b"abc", 32));
+
+        // Upper boundary: 7 bits is the largest valid partial byte and must be accepted, and must
+        // actually change the output relative to the byte-aligned message.
+        let mut b = SHAKE128::new();
+        b.absorb(b"abc").unwrap();
+        b.absorb_last_partial_byte(0x7F, 7).unwrap();
+        assert_ne!(b.squeeze(32), SHAKE128::new().hash_xof(b"abc", 32));
+    }
+
     /// Once squeezing has begun, a SHAKE cannot return to absorbing (FIPS 202 defines SHAKE as a
     /// single function of the whole message). Both absorb entry points must reject a post-squeeze call
     /// with `HashError::InvalidState` rather than panicking, and a rejected call must leave the sponge
@@ -100,7 +172,7 @@ mod shake_tests {
 
     #[test]
     fn test_update_bytes() {
-        for tc in read_test_vectors("tests/data/SHAKETestVectors.txt") {
+        for tc in read_test_vectors("SHAKETestVectors.txt") {
             //println!("SHAKE-{} {}-bits", &tc.algorithm, &tc.bits);
             //println!("msg {}", hex::encode_upper(&tc.msg));
             //println!("hashes {}", hex::encode_upper(&tc.output));
@@ -271,7 +343,7 @@ mod shake_tests {
 
     #[test]
     fn run_kats() {
-        run_test_vectors(read_test_vectors("tests/data/SHAKETestVectors.txt"));
+        run_test_vectors(read_test_vectors("SHAKETestVectors.txt"));
     }
 
     #[test]
@@ -381,6 +453,34 @@ mod shake_tests {
 pub(crate) mod shake_test_helpers {
     use bouncycastle_hex as hex;
     use std::fs;
+    use std::path::Path;
+    use std::sync::Once;
+
+    // Test vectors are read from the bc-test-data repo (https://github.com/bcgit/bc-test-data),
+    // which must be cloned alongside this repo at "../bc-test-data" (same convention as the mldsa
+    // and mlkem crates). If it is not present the vector tests print a warning and pass vacuously.
+    const TEST_DATA_PATH_RELATIVE: &str = "../../../bc-test-data/crypto";
+    const TEST_DATA_PATH: &str = "../bc-test-data/crypto";
+
+    static TEST_DATA_CHECK: Once = Once::new();
+
+    /// Returns the contents of `filename` from bc-test-data, or `None` (after a one-time warning)
+    /// if the repo is not checked out.
+    fn get_test_data(filename: &str) -> Option<String> {
+        let dir =
+            [TEST_DATA_PATH_RELATIVE, TEST_DATA_PATH].into_iter().find(|d| Path::new(d).exists());
+        TEST_DATA_CHECK.call_once(|| match dir {
+            Some(d) => println!("bc-test-data found at: {d:?}"),
+            None => {
+                println!("WARNING: bc-test-data directory not found; vector tests will be skipped")
+            }
+        });
+        let dir = dir?;
+        Some(
+            fs::read_to_string(format!("{dir}/{filename}"))
+                .expect("failed to read test vector file"),
+        )
+    }
 
     const SAMPLE_OF: &str = " sample of ";
     const MSG_HEADER: &str = "Msg as bit string";
@@ -393,10 +493,14 @@ pub(crate) mod shake_test_helpers {
         pub(crate) output: Vec<u8>,
     }
 
-    pub(crate) fn read_test_vectors(path: &str) -> Vec<TestCase> {
+    /// Parses the named NIST FIPS 202 example-vector file from bc-test-data. Returns an empty list
+    /// (skipping the test) if bc-test-data is not available.
+    pub(crate) fn read_test_vectors(filename: &str) -> Vec<TestCase> {
         let mut test_vectors: Vec<TestCase> = vec![];
-        let string_content: Vec<String> =
-            fs::read_to_string(path).unwrap().lines().map(String::from).collect();
+        let Some(content) = get_test_data(filename) else {
+            return test_vectors;
+        };
+        let string_content: Vec<String> = content.lines().map(String::from).collect();
 
         let mut i = 0;
         while i < string_content.len() {
diff --git a/mem_usage_benches/Cargo.toml b/mem_usage_benches/Cargo.toml
index 53c35f9a..a3623aac 100644
--- a/mem_usage_benches/Cargo.toml
+++ b/mem_usage_benches/Cargo.toml
@@ -14,3 +14,7 @@ path = "bench_mldsa_mem_usage.rs"
 [[bin]]
 name = "bench_mlkem_mem_usage"
 path = "bench_mlkem_mem_usage.rs"
+
+[[bin]]
+name = "bench_sha3_mem_usage"
+path = "bench_sha3_mem_usage.rs"
diff --git a/mem_usage_benches/bench_sha3_mem_usage.rs b/mem_usage_benches/bench_sha3_mem_usage.rs
new file mode 100644
index 00000000..e4155b61
--- /dev/null
+++ b/mem_usage_benches/bench_sha3_mem_usage.rs
@@ -0,0 +1,122 @@
+//! The purpose of this binary is to perform a single run of the primitive under test so that
+//! its peak memory usage can be measured with:
+//!
+//!     valgrind --tool=massif --heap=no --stacks=yes -- target/release/bench_sha3_mem_usage > /dev/null
+//!
+//!     ms_print massif.out.835000
+//!
+//! or, shoved all into one line:
+//!
+//!     clear; clear; valgrind --tool=massif --heap=no --stacks=yes -- target/release/bench_sha3_mem_usage > /dev/null; ms_print massif.out.*; rm massif.out.*
+//!
+//! Make sure you build in release mode!
+//!
+//! The code is using print!() to force the compiler not to optimize away the actual code.
+//! It is printing important outputs for benchmarking to stderr so that the rest can be mapped to /dev/null
+//! (this is because /usr/bin/time prints useful outputs to stderr as well)
+//!
+//! Main is at the bottom, controls which this was actually run. `print_struct_sizes()` is the source of
+//! the numbers in the "Memory Usage" table in the bouncycastle-sha3 crate docs.
+
+#![allow(dead_code)]
+#![allow(unused_imports)]
+
+use bouncycastle::core::traits::{Hash, Suspendable, XOF};
+use bouncycastle::sha3::{
+    SHA3_224, SHA3_256, SHA3_384, SHA3_512, SHAKE128, SHAKE256, SUSPENDED_SHA3_STATE_LEN,
+};
+
+/// A 1 KiB message so that the sponge is permuted several times.
+const MSG: [u8; 1024] = [0xA5; 1024];
+
+/// This prints the in-memory size of all the hash / XOF objects and the suspended state.
+fn print_struct_sizes() {
+    use core::mem::size_of;
+
+    println!("\nSHA3 / SHAKE");
+    println!("size_of<SHA3_224>: {}", size_of::<SHA3_224>());
+    println!("size_of<SHA3_256>: {}", size_of::<SHA3_256>());
+    println!("size_of<SHA3_384>: {}", size_of::<SHA3_384>());
+    println!("size_of<SHA3_512>: {}", size_of::<SHA3_512>());
+    println!("size_of<SHAKE128>: {}", size_of::<SHAKE128>());
+    println!("size_of<SHAKE256>: {}", size_of::<SHAKE256>());
+    println!("SUSPENDED_SHA3_STATE_LEN: {}", SUSPENDED_SHA3_STATE_LEN);
+}
+
+fn bench_do_nothing() {
+    eprintln!("DoNothing");
+
+    print!("{}", 1 + 1);
+}
+
+fn bench_sha3_256_hash() {
+    eprintln!("SHA3-256/hash");
+
+    let mut out = [0u8; 32];
+    SHA3_256::new().hash_out(&MSG, &mut out);
+    println!("{:x?}", out);
+}
+
+fn bench_sha3_512_hash() {
+    eprintln!("SHA3-512/hash");
+
+    let mut out = [0u8; 64];
+    SHA3_512::new().hash_out(&MSG, &mut out);
+    println!("{:x?}", out);
+}
+
+fn bench_sha3_256_streaming() {
+    eprintln!("SHA3-256/do_update+do_final_out");
+
+    let mut h = SHA3_256::new();
+    for chunk in MSG.chunks(100) {
+        h.do_update(chunk);
+    }
+    let mut out = [0u8; 32];
+    h.do_final_out(&mut out);
+    println!("{:x?}", out);
+}
+
+fn bench_shake128_xof() {
+    eprintln!("SHAKE128/absorb+squeeze_out");
+
+    let mut x = SHAKE128::new();
+    x.absorb(&MSG).expect("absorb before squeeze is infallible");
+    let mut out = [0u8; 512];
+    x.squeeze_out(&mut out);
+    println!("{:x?}", out);
+}
+
+fn bench_shake256_xof() {
+    eprintln!("SHAKE256/absorb+squeeze_out");
+
+    let mut x = SHAKE256::new();
+    x.absorb(&MSG).expect("absorb before squeeze is infallible");
+    let mut out = [0u8; 512];
+    x.squeeze_out(&mut out);
+    println!("{:x?}", out);
+}
+
+fn bench_sha3_256_suspend_resume() {
+    eprintln!("SHA3-256/suspend+from_suspended");
+
+    let mut h = SHA3_256::new();
+    h.do_update(&MSG[..500]);
+    let state = h.suspend();
+    let mut h = SHA3_256::from_suspended(state).expect("round-trip of a freshly suspended state");
+    h.do_update(&MSG[500..]);
+    let mut out = [0u8; 32];
+    h.do_final_out(&mut out);
+    println!("{:x?}", out);
+}
+
+fn main() {
+    print_struct_sizes()
+    // bench_do_nothing()
+    // bench_sha3_256_hash()
+    // bench_sha3_512_hash()
+    // bench_sha3_256_streaming()
+    // bench_shake128_xof()
+    // bench_shake256_xof()
+    // bench_sha3_256_suspend_resume()
+}
diff --git a/mem_usage_benches/lib.rs b/mem_usage_benches/lib.rs
index d296f2c1..a281a8b2 100644
--- a/mem_usage_benches/lib.rs
+++ b/mem_usage_benches/lib.rs
@@ -1,2 +1,3 @@
 mod bench_mldsa_mem_usage;
-mod bench_mlkem_mem_usage;
\ No newline at end of file
+mod bench_mlkem_mem_usage;
+mod bench_sha3_mem_usage;