is HMAC-SHA512 quantum safe , I am planning to use it for encrypt-then-mac scheme with aes256-cfb mode for a post quantum safe PGP like protocol.
$\begingroup$
$\endgroup$
6
-
$\begingroup$ Done my best whilst on the move on mobile. $\endgroup$– samuel-lucas6Jul 19, 2022 at 10:33
-
1$\begingroup$ Why CFB mode? It's not very popular as far as I know. $\endgroup$– samuel-lucas6Jul 19, 2022 at 10:34
-
$\begingroup$ I am using CFB to avoid using padding and it is generally faster than CBC, i found gnupg program using CFB mode so thought to use it. $\endgroup$– ANISH M 18CS006Jul 19, 2022 at 16:07
-
$\begingroup$ Avoiding padding makes sense, but there's a lot wrong with GPG, so I would recommend not basing design decisions on it. AES-CTR is likely the most used AES mode currently because it's used within AES-GCM, AES-CCM, AES-EAX, and so on. If you're looking for maximum performance, you'd be best off with something like AES-OCB or AEGIS, but those are AEADs, so you wouldn't need Encrypt-then-MAC. They're post-quantum secure, but AES-OCB is not key committing and AEGIS has not been officially looked at regarding key commitment. $\endgroup$– samuel-lucas6Jul 19, 2022 at 16:42
-
$\begingroup$ Thanks @samuel-lucas6 , i am planning to use AES-OCB , is not key committing cause any security issue for PGP like application , going to use AES-OCB in hybrid cryptography $\endgroup$– ANISH M 18CS006Jul 20, 2022 at 5:46
|
Show 1 more comment
1 Answer
$\begingroup$
$\endgroup$
Yes, HMAC-SHA512 offers at least a 256-bit security level assuming a 256-bit+ key. Specifically, 256-bit collision resistance and 512-bit preimage/second preimage resistance, which is more important for MACs.
A 512-bit key is unnecessary as 512-bit preimage/second preimage resistance is excessive. However, it can be good for domain separation, and a key as long as the output length is often recommended so you don't get a security reduction.
Just make sure you derive a separate encryption key and MAC key using a KDF with the same input keying material. That's good practice and makes Encrypt-then-MAC committing.
