If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did I understand this right?
2
-
3$\begingroup$ Actually, AES-128 is quantum safe; $2^{64}$ serial AES evaluations are impractical (and even if it was, CMAC can be used with AES-256). And, HMAC can be used with any Merkle-Damgard hash (which SHA-3 isn't; I suppose you could use any hash, but you'd need to redo the security proof) - perhaps you meant KMAC? $\endgroup$– ponchoMar 11 at 21:12
-
$\begingroup$ I think the long and short of this is: no you haven't understood this correctly. Um, should we leave this question open? It seems to have been answered. I would be more happy with the question if it had some references for the claims (which is probably why poncho posted an off-hand comment). If you are unsure, use AES-256, KMAC-256 or even HMAC-SHA-256 or 512. $\endgroup$– Maarten Bodewes ♦Mar 12 at 0:42
Add a comment
|