pbarreto

And since we're at this, perhaps you meant c _between_ 448 and 1024, according to the sec level?

Also, this setting does not address the security of MAC constructions based on SHA-3.

For instance, HMAC over SHA-2-256 or SHA-2-512/256 with a 256-bit key is expected to attain 256-bit security (i.e. the MAC size equals the security level).

Yet SHA-3-256 would not reach anything above 128-bit security, even though the MAC is 256 bits long; to attain 256-bit security one would have to scale the MAC size up to 512 bits instead.