Where did SHAKE128 and SHAKE256 originate from?
I am trying to find them in the original Keccak documentation but can't find them.
Is it some special mode of Keccak referenced in the documentation? Or something invented by NIST and added to the SHA3 standard?
Any public cryptanalysis done on them?
Where did SHAKE128 and SHAKE256 originate from?
They follow from the general properties of the sponge construction. A sponge function can generate an arbitrary length of output. The submission of Keccak to the SHA-3 competition proposed a single "XOF" (extendable-output function) with a user defined length, which would have been essentially SHAKE-288. NIST seems to have decided on two instead, with more "normal" security levels.
Any public cryptanalysis done on them?
Anything on the generic Keccak function may also apply to them. I don't know of any cryptanalysis specifically on the XOFs, beyond what was done by the authors themselves in the submissions and the site I linked above. However, a comment (pdf) to the draft standard complains that the usage of XOFs (i.e. SHAKEs) is not defined well enough and that their security claim is not very rigorously stated.
