I'm looking at three options for shared-secret message authentication codes:
- HMAC-SHA-256(secret, payload)
- SHA-512/256(secret+payload)
- SHA-512(secret+payload) truncated to 256 bits
Option 1 is the most standard choice. I'm considering option 2 because it is faster on 64-bit CPUs. I'm considering option 3 because SHA-512 is more widely available in programming language libraries than SHA-512/256.
Are options 2 and 3 appropriate for MACs? Are there any security-related reasons to pick one over the other?
Clarification: I realize that a good HMAC-SHA-256 implementation is not significantly slower than SHA-256. I'm considering options 2 and 3 because SHA-512 is faster than SHA-256 on 64-bit machines (link).
Background: Some cryptographic hash functions (like SHA-256 and SHA-512) are "length-extendable". This is not necessarily a problem because correct uses of a hash function should not be affected by that property. But you can't use such a hash function directly as a MAC because, in that use case, the signature and input both come from an untrusted source (length extension attack).
SHA-512/256 is a hash function based on SHA-512 that is not length-extendable. (It's similar to running SHA-512 and only using the first 256 bits of output, which is also not length-extendable.) My question was whether these two hash functions could be directly used as MACs.