Did NIST verify “post-quantum” claims in the SHA3 proposal papers?
With any $n$ bit hash it is possible to:


Find preimages with work $2^n$ on classical computers and $2^{n/2}$ using quantum computers
Find collisions with work $2^{n/2}$ on classical computers and $2^{n/3}$ using quantum computers


I want to emphasize that these are generic attacks that always work, no matter which concrete hashfunction is used. Grover's algorithm is the quantum mechanical equivalent of classical brute-force.

For sponges (including keccak and cubehash) if $c$ is smaller than $2n$ there are other generic attacks:


Find preimages with work $2^{c/2}$ on classical computers and $2^{c/3}$ using quantum computers
Find collisions with work $2^{c/2}$ on classical computers and $2^{c/3}$ using quantum computers




Now several authors of SHA-3 candidates simply wrote "preimages with work $2^n$" and "collisions with work $2^{n/2}$" without explicitly stating that these claims only apply to classical computers. The intention of these claims was clearly "no faster than brute-force attacks", but they only spelled it out explicitly for classical computers.

Some authors (like DJB himself) carefully specified the above limits separately for classical computers and quantum computers, and some simply wrote that the "usual security levels apply".

Now DJB argues that since the security level against quantum computers violate the security claims, they're an attack against those hashes. The same attacks apply to cubehash as well, except that they don't violate its security claims.

The paper is the simple observation that some papers didn't mention the generic quantum computer attacks and didn't clearly restrict their claims to classical computers. It's about a really minor sloppiness in those papers, I'd expect every cryptographer to know that these claims don't apply to quantum computers.

The paper does not contain any new attacks or findings, only nitpicks.