# Is it generally okay to substitute “like for like”?

Is it generally okay to substitute “like for like” in cryptographic protocols?

For example, many lattice protocols use SHAKE and SHA3 for various purposes. However, both of those are relatively slow in software.

If I substitute Blake2X and Blake2b for these respectively, will the resulting (incompatible) protocol still be secure? Similarly, if a protocol calls for an AEAD, and specifies AES-GCM, can I substitute ChaCha20-Poly1305 instead and still get a secure protocol?

If the protocol has a proof of security that abstracts the underlying primitives (i.e. if the theorem statement contains a phrase like "Let $blah$ be an AEAD scheme" and the proof contains a reduction to the AEAD security of $blah$) that proof should still more or less hold. If there is no proof of security you have two options: (a) write one and make sure the reduction goes through or (b) just make an educated guess. I recommend (a).