code: func (d *digest) squeeze(in []byte, toSqueeze int) []byte {
  	// Because we read in blocks of laneSize, we need enough room to read
  	// an integral number of lanes
  	needed := toSqueeze + (laneSize-toSqueeze%laneSize)%laneSize
  	if cap(in)-len(in) < needed {
  		newIn := make([]byte, len(in), len(in)+needed)
  		copy(newIn, in)
  		in = newIn
  	}
  	out := in[len(in) : len(in)+needed]
  
  	for len(out) > 0 {
  		for i := 0; i < d.rate() && len(out) > 0; i += laneSize {
  			binary.LittleEndian.PutUint64(out[:], d.a[i/laneSize])
  			out = out[laneSize:]
  		}
  		if len(out) > 0 {
  			d.keccakF()
  		}
  	}
  	return in[:len(in)+toSqueeze] // Re-slice in case we wrote extra data.
  }
docs: // squeeze outputs an arbitrary number of bytes from the hash state.
  // Squeezing can require multiple calls to the F function (one per rate() bytes squeezed),
  // although this is not the case for standard SHA3 parameters. This implementation only supports
  // squeezing a single time, subsequent squeezes may lose alignment. Future implementations
  // may wish to support multiple squeeze calls, for example to support use as a PRNG.