# Why would we want parallelizable authentication?

I believe that parallelizable authentication schemes are superior from an aesthetic perspective and because most non-recursive calculations (e.g., CTR, ECB, PMAC, etc.) are better than recursive ones (e.g., CBC, OFB, CFB, CBC-MAC, etc.).

Most of the CAESAR candidates, i.e. GCM, OCB mode, PMAC, XOR-MACs, and protected counter sum provide parallelizable authentication while HMAC is not parallelizable.

One paper out there says that many schemes used by the CAESAR candidates, GCM, and XOR-MACs can be trivially broken by an incredibly unrealistic quantum attack (it turns the complexity from $O(2^{n})$ to $O(n)$ but requires a quantum entangled state that can only be generated with the key). Additionally, with or without quantum computers, many of these parallelizable authentication schemes only provide security up the birthday bound. This makes it seem like a lot of the known parallelizable modes of authentication are not as strong as an HMAC construction.

Am I mistaken? Is there anything about most particular parallelizable methods that have drawbacks/weaknesses relative to HMACs? If so, what are they? And why do we seek parallelizable methods if that is the case?