Is SHA-384 Quantum Safe?

SHA-384 IS quantum safe.

How SHA-384 Works

SHA-384 is a truncated variant of SHA-512, both part of the SHA-2 family designed by the NSA and standardized by NIST in FIPS 180-4. SHA-384 uses the same internal 512-bit state and 64-round compression function as SHA-512 but outputs only the first 384 bits of the final hash value. This design provides stronger collision resistance than SHA-256 (192 bits vs. 128 bits classically) while maintaining excellent performance on 64-bit processors.

SHA-384 processes input in 1024-bit blocks (twice the size of SHA-256's 512-bit blocks) using eight 64-bit working variables. The algorithm is optimized for 64-bit architectures, often performing faster than SHA-256 on modern CPUs despite producing a larger output.

SHA-384 is standardized in FIPS 180-4. CNSA 2.0 specifies SHA-384 or SHA-512 for general-purpose hashing across its NSS classification scope; other sectors and protocols follow their own approved profiles.

Quantum Vulnerability Explained

Grover's algorithm provides a quadratic speedup against hash functions, reducing security levels by a square root factor. For SHA-384:

Preimage resistance: The idealized query model falls from roughly 2³⁸⁴ classically to roughly 2¹⁹² with Grover search. Concrete circuit, error-correction, parallelization, and verification costs are architecture-dependent.

Collision resistance: Classically requires approximately 2¹⁹² operations (birthday attack). Quantum collision-finding algorithms (Brassard-Høyer-Tapp) reduce this to approximately 2^(384/3) ≈ 2¹²⁸ quantum operations. This matches the 128-bit post-quantum security threshold NIST recommends, providing exactly the security margin desired for long-term protection.

CNSA 2.0 specifies SHA-384 or SHA-512 for general-purpose hashing within its NSS scope. That choice does not establish a universal commercial mandate or a guaranteed security date through 2050.

Migration Path

No migration required for SHA-384 — it is the recommended hash function for post-quantum high-security applications. Organizations should consider:

• Adopt SHA-384 as default: For government, defense, healthcare, and financial systems handling sensitive long-term data, SHA-384 should be the minimum hash function.
• TLS cipher suite preference: Configure TLS 1.3 to prioritize TLS_AES_256_GCM_SHA384 over TLS_AES_256_GCM_SHA256 for connections requiring post-quantum security margins.
• Certificate hierarchies: Use SHA-384 for root CA and intermediate CA certificate signatures, especially for certificates with 10+ year lifetimes.
• HMAC and key derivation: Implement HMAC-SHA384 and HKDF-SHA384 for generating cryptographic keys from master secrets.

Industries at Risk

SHA-384's algorithm-level margin does not remove construction, implementation, key-management, or signature-layer risk:

Government and defense: CNSA 2.0 specifies SHA-384 or SHA-512 for general-purpose hashing across its NSS classification scope. Signature algorithms and application profiles must be assessed separately.

Financial services: Select a hash through the applicable payment, signature, logging, and retention profiles. A sector label does not create a universal SHA-384 requirement or compliance result.

Healthcare: Medical research involving genomic data, clinical trials, and long-term patient records benefits from SHA-384's conservative security margins, ensuring hash integrity through multi-decade data retention periods.

Timeline

• Current status: SHA-384 is standardized. Select it where the governing profile and construction require its margin.
• CNSA 2.0 scope: SHA-384 or SHA-512 is specified for general-purpose NSS hashing; this is not a universal 2030 commercial deadline.
• Current status: No universal SHA-384 deprecation date is identified; continue to monitor authoritative standards.

Use SHA-384 where its output size, construction, and governing profile fit the application; do not infer an end-to-end security or retention guarantee from the hash alone.