If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did I understand this right?

  • 3
    $\begingroup$ Actually, AES-128 is quantum safe; $2^{64}$ serial AES evaluations are impractical (and even if it was, CMAC can be used with AES-256). And, HMAC can be used with any Merkle-Damgard hash (which SHA-3 isn't; I suppose you could use any hash, but you'd need to redo the security proof) - perhaps you meant KMAC? $\endgroup$
    – poncho
    Mar 11 at 21:12
  • $\begingroup$ I think the long and short of this is: no you haven't understood this correctly. Um, should we leave this question open? It seems to have been answered. I would be more happy with the question if it had some references for the claims (which is probably why poncho posted an off-hand comment). If you are unsure, use AES-256, KMAC-256 or even HMAC-SHA-256 or 512. $\endgroup$
    – Maarten Bodewes
    Mar 12 at 0:42


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.