Looks like a good start. I think this should be adopted. I would like to see
(Turbo)SHAKE used much more.
Assuming a sufficiently large key size such that brute-force key-recovery
attacks can be neglected, a strong 128-bit MAC algorithm should satisfy
E(F) ≈ v / 2^128 ,
for all permitted invocation counts and message lengths, where v is the number
of forgery attempts. The algorithms in this document does that.
---
I think the draft needs more motivation for the design choices.
RFC 9861 Section 4 recommends:
HopMAC128(Key, M, C, L) = KT128(Key, KT128(M, C, 32), L)
and writes that one MAY use:
MAC = KT128(M, Key, L)
SP 800-185 (KMAC) does:
M' = K || M || L
In general, using the key as prefix rather than a suffix is recommended. I
don't see any benefits with the key as suffix.
---
Are 256-bit MACs needed for anything?
---
Cheers,
John Preuß Mattsson
From: Quynh Dang <[email protected]>
Date: Tuesday, 7 July 2026 at 00:41
To: Blumenthal, Uri - 0553 - MITLL <[email protected]>
Cc: Dang, Quynh H. (Fed) <[email protected]>; cose
<[email protected]>
Subject: [COSE] Re: KangarooTwelve, TurboSHAKE and KMAC for COSE.
Hi Uri,
NIST does not have an active plan to standardize them at this moment.
The options with KMACs are for the users who would like to use NIST-approved
options.
The options with KangarooTwelves and TurboSHAKEs are not NIST-approved. They
have better performance than the options with KMACs and they are also more cost
efficient for masked implementations (to protect against side channel attacks).
Regards,
Quynh.
On Mon, Jul 6, 2026 at 3:44 PM Blumenthal, Uri - 0553 - MITLL
<[email protected]<mailto:[email protected]>> wrote:
Quynh,
Could we read from the fact that you co-authored this draft, that NIST may
consider standardizing KangarooTwelve and TurboSHAKE?
Or is it your personal participation only?
TNX
--
V/R,
Uri
There are two ways to design a system. One is to make it so simple there are
obviously no deficiencies.
The other is to make it so complex there are no obvious deficiencies.
C. A. R. Hoare
From: Dang, Quynh H. (Fed)
<[email protected]<mailto:[email protected]>>
Date: Monday, July 6, 2026 at 13:34
To: Michael Jones
<[email protected]<mailto:[email protected]>>;
[email protected]<mailto:[email protected]>
<[email protected]<mailto:[email protected]>>
Cc: cose <[email protected]<mailto:[email protected]>>
Subject: [EXT] [COSE] KangarooTwelve, TurboSHAKE and KMAC for COSE.
This Message Is From an External Sender
This message came from outside the Laboratory.
Hi Mike and Ivaylo,
Carsten and I would like to ask you for 10 minutes to present the draft below
at the upcoming IETF 126.
https://datatracker.ietf.org/doc/draft-bormann-cose-turbo-kanga-kmac/
Thank you and Regards,
Quynh.
_______________________________________________
COSE mailing list -- [email protected]<mailto:[email protected]>
To unsubscribe send an email to [email protected]<mailto:[email protected]>
_______________________________________________
COSE mailing list -- [email protected]
To unsubscribe send an email to [email protected]
