# Which MAC scheme is quantum resistant?

Will HMAC resist Grover's algorithm? If not, which MAC scheme will provide post-quantum security?

Yes, HMAC with a sufficiently long key will survive Grover's algorithm. Grover's algorithm breaks a cryptosystem with a $n$-bit key using $2^{n/2}$ (quantum) steps of computation. Therefore, in practice, a 128-bit key is likely to survive Grover's algorithm, and a 160-bit key almost surely will.