init(SHA3(pass + s));

https://github.com/darkjpeg/darkjpeg.github.io/blob/07171bd0...

That's worrisome; they should be using a purpose-built key derivation function, like PBKDF2, bcrypt or scrypt. Using only SHA3 means it is easy to brute-force the key by searching for likely passwords.

That they're using SHA3 as a key generation function to convert a passphrase to a key for encryption? What else would it mean?

See the reply by capnrefsmmat

The wisdom of using a homegrown sha-3 based algorithm for key generation is separate from what "sha-3 key generation" means.

Well it's got to be super sekrit so it needs the best SHA algorithm, what better than the one that even the NSA hasn't picked yet? :-)

I thought Keccak has already been chosen to be SHA-3, is it not the case?

Oh I'm sure the NSA has already picked it ;) NIST just hasn't yet...

Keccak was picked by NIST last October as the winner of the SHA-3 competition.