HMAC was introduced in [1], as a MAC that has its security proof based on the properties on the underlaying hash function.

The hash functions considered in that paper were ones based on the Merkle-Damgaard paradigm where in most cases, block sizes that messages're chunked into are greater than the output length of the hash function. For keys larger than then block size, the key will be hashed before use.

After the success of Keccak/SHA-3, permutation-based cryptography becomes increasingly popular, and I noticed something a bit strange. The Gimli hash function as proposed in its current form [2] in the Round 2 of NIST Lightweight Cryptography project, has capacity only capable of 128-bit overall security, for both collision and pre-image resistance, but with a 256-bit output.

Q: What will happen if HMAC was instantiated with Gimli? Will the security strength of HMAC-Gimli256 decrease from 256-bit to 128-bit and why and how? Can it use keys larger than 128 bits?

  • $\begingroup$ I asked a related question. Bottom line: we no longer need HMAC with SHA-3, but it still works. $\endgroup$
    – fgrieu
    Commented Dec 1, 2020 at 9:07
  • $\begingroup$ @fgrieu well, I'm asking about Gimli, which has a more radical parameter set. I guess that could be an answer point. $\endgroup$
    – DannyNiu
    Commented Dec 1, 2020 at 13:10


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.