For use use in Encrypt then MAC scheme i am considering using HMAC-SHA256 with 256 bit key, i am wondering if i should use HMAC-SHA512 to be post quantum secure, will simply using HMAC with 256 bit key alone irrespective of hash function will be post quantum secure?
$\begingroup$
$\endgroup$
8
-
2$\begingroup$ Does this answer to your question Which MAC scheme is quantum resistant?? $\endgroup$– kelalakaAug 27, 2022 at 12:40
-
$\begingroup$ HMAC-SHA-256 is fine. You don't need a tag greater than 256 bits because that already gives you 256-bit security if you ignore generic attacks that are impractical. However, you shouldn't use HMAC-MD5 or HMAC-SHA1 nowadays. $\endgroup$– samuel-lucas6Aug 27, 2022 at 12:47
-
$\begingroup$ @kelalaka i referred that link but since it was 9 years old , i thought if those stuff were still valid today. It mentions HMAC of any keylength can be used for any hash algorithm and it will be secure , i wonder if a broken hash is used for hmac will it be still secure? From samuel-lucas6 sir's comment i guess broken hash shouldn't be used for hmac , just wondering if sha256 gets obsolete or broken in quantum age will hmac-sha256 will still be secure. $\endgroup$– ANISH M 18CS006Aug 27, 2022 at 13:05
-
$\begingroup$ That is really depend on your applications $\endgroup$– kelalakaAug 27, 2022 at 13:17
-
1$\begingroup$ @kelalaka: Grover's algorithm is essentially optimal, assuming that you attack the crypto (HMAC in this case) as a black box; you may be able to do better (if you have insight into how the crypto operates internally). As for Brassard's attack, that doesn't apply - it's trying to find collisions, and collisions don't apply to HMAC. $\endgroup$– ponchoAug 28, 2022 at 21:38
|
Show 3 more comments