[CFRG] K12, HopMAC and short inputs

[[e-mail]]

Hi all,

I am picking up a conversation that I found on /r/crypto on Reddit.

According to Gilles Van Assche (/u/docgcrypto), the Hash-then-MAC 
approach instantiated as HopMAC in the KangarooTwelve draft is needed to 
protect against side-channel attacks like DPA. This is not a threat in 
desktop/server-class machines and only of relevance for microcontrollers 
in certain scenarios as well as perhaps hardware implementations.

HopMAC causes overhead of an extra invocation, which for very short 
inputs such as key derivation can be very significant.

Perhaps a brief rationale above the definition of HopMAC/the "SHOULD use 
a HASH-then-MAC construction" paragraph could be given as to advise 
people when they can disregard the "SHOULD".

Perhaps one may also argue that for short (say, < 128 bytes) inputs, one 
ought to instead prefer a short-input hash function such as Haraka v2, 
but the state of the art for short input MACs seems unclear.

Thank you for your guidance and time.

Cheers,

Mark 'pandame' Rogers