SHA-384 remains standardized and provides a large current margin under generic quantum preimage and collision models. Suitability still depends on the construction and assurance profile.
Key Takeaway: SHA-384 is considered quantum safe. SHA-384 is standardized in FIPS 180-4. CNSA 2.0 specifies SHA-384 or SHA-512 for general-purpose hashing within its NSS scope.
SHA-384 IS quantum safe.
SHA-384 is a truncated variant of SHA-512, both part of the SHA-2 family designed by the NSA and standardized by NIST in FIPS 180-4. SHA-384 uses the same internal 512-bit state and 64-round compression function as SHA-512 but outputs only the first 384 bits of the final hash value. This design provides stronger collision resistance than SHA-256 (192 bits vs. 128 bits classically) while maintaining excellent performance on 64-bit processors.
SHA-384 processes input in 1024-bit blocks (twice the size of SHA-256's 512-bit blocks) using eight 64-bit working variables. The algorithm is optimized for 64-bit architectures, often performing faster than SHA-256 on modern CPUs despite producing a larger output.
SHA-384 is standardized in FIPS 180-4. CNSA 2.0 specifies SHA-384 or SHA-512 for general-purpose hashing across its NSS classification scope; other sectors and protocols follow their own approved profiles.
Grover's algorithm provides a quadratic speedup against hash functions, reducing security levels by a square root factor. For SHA-384:
Preimage resistance: The idealized query model falls from roughly 2384 classically to roughly 2192 with Grover search. Concrete circuit, error-correction, parallelization, and verification costs are architecture-dependent.
Collision resistance: Classically requires approximately 2192 operations (birthday attack). Quantum collision-finding algorithms (Brassard-Høyer-Tapp) reduce this to approximately 2(384/3) ≈ 2128 quantum operations. This matches the 128-bit post-quantum security threshold NIST recommends, providing exactly the security margin desired for long-term protection.
CNSA 2.0 specifies SHA-384 or SHA-512 for general-purpose hashing within its NSS scope. That choice does not establish a universal commercial mandate or a guaranteed security date through 2050.
No migration required for SHA-384 — it is the recommended hash function for post-quantum high-security applications. Organizations should consider:
SHA-384's algorithm-level margin does not remove construction, implementation, key-management, or signature-layer risk:
Government and defense: CNSA 2.0 specifies SHA-384 or SHA-512 for general-purpose hashing across its NSS classification scope. Signature algorithms and application profiles must be assessed separately.
Financial services: Select a hash through the applicable payment, signature, logging, and retention profiles. A sector label does not create a universal SHA-384 requirement or compliance result.
Healthcare: Medical research involving genomic data, clinical trials, and long-term patient records benefits from SHA-384's conservative security margins, ensuring hash integrity through multi-decade data retention periods.
Use SHA-384 where its output size, construction, and governing profile fit the application; do not infer an end-to-end security or retention guarantee from the hash alone.
| Full Name | Secure Hash Algorithm 384-bit |
| Category | hash |
| Quantum Vulnerability | Grover reduces preimage to 192 bits. Still highly secure. |
| NIST Status | SHA-384 is standardized in FIPS 180-4. CNSA 2.0 specifies SHA-384 or SHA-512 for general-purpose hashing within its NSS scope. |
| Deprecation Timeline | No current universal deprecation date. CNSA 2.0 specifies SHA-384 or SHA-512 for general-purpose hashing within its NSS scope. |
| Replaced By | No replacement needed — SHA-384 is quantum resistant |
Algorithm-level classification. Standards status and known cryptanalysis are separated from implementation, module-validation, protocol-composition, key-management, and policy evidence.
Evidence-scope review: 2026-07-10
No migration needed. SHA-384 is the preferred hash for high-security post-quantum applications.
SHA-384 is quantum safe, but your cryptographic posture is only as strong as its weakest link. QScout maps cryptographic inventory within approved scope under a governed engagement.