The first 512 bits (64 bytes) of the SHAKE256 output. This is the prehashing for Ed448ph (see #PSA_ALG_ED448PH). For other scenarios where a hash function based on SHA3/SHAKE is desired, SHA3-512 has the same output size and a (theoretically) higher security strength.