{
  input: {
    string S,
    number nr
  }
  output: {
    string S' `length b`
  }
  step: {
    1. 将S转换为state array A,如Sec 3.1.2中的定义
    2. for (let ir = 12+2l-nr; i <= 12+2l-1;) A = Rnd(A, ir)
    3. 将A转换成长度为b的字符串S',如Sec 3.1.3中定义
    4. 返回S'
  }
}

KECCAK-f[b] = KECCAK-p[b, 12+2l]
KECCAK-f[1600] = KECCAP-p[1600, 24]

underlying function: KECCAK-p[b, 12+2l] (Sec 3.3)
padding rule: pad10*1 (Sec 5.1)

rate r, capacity c
b = r + c -> {25, 50, 100, 200, 400, 800, 1600}

b = 1600
KECCAK[c] = SPONGE[ KECCAK-p[1600,24], pad10*1, 1600-c ]
KECCAK[c](N, d) = SPONGE[ KECCAK-p[1600,24], pad10*1, 1600-c ](N, d)

message M
SHA3-224(M) = KECCAK[448] (M || 01, 224)
SHA3-256(M) = KECCAK[512] (M || 01, 256)
SHA3-384(M) = KECCAK[768] (M || 01, 384)
SHA3-512(M) = KECCAK[1024](M || 01, 512)