Encrypt or Decrypt? To Make a Single-Key Beyond Birthday Secure Nonce-Based MAC

Datta, Nilanjan; Dutta, Avijit; Nandi, Mridul; Yasuda, Kan

doi:10.1007/978-3-319-96884-1_21

Cited by 29 publications

(34 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Published and new contents. In [8], Datta et al proposed DWCDM and showed that if the nonce space is restricted to 2n/3 bits, DWCDM is secured roughly up to 2 2n/3 MAC queries and 2 n verification queries against nonce respecting adversaries. Here we extend this result and prove that the result holds even if we restrict the nonce space to (n − 1)-bits.…”

Section: Introductionmentioning

confidence: 99%

“…The basic structure remains same. We begin with the Extended Mirror Theory as was used in [8]. However, the result proven in [8] is valid when the block maximality (as defined in [16]) or equivalently component size is restricted to 2.…”

Section: Introductionmentioning

confidence: 99%

“…We begin with the Extended Mirror Theory as was used in [8]. However, the result proven in [8] is valid when the block maximality (as defined in [16]) or equivalently component size is restricted to 2. Here, restricting the nonce space to (n − 1)-bits demands extending the analysis with component size restricted to n (the size of the underlying block cipher).…”

Section: Introductionmentioning

confidence: 99%

“…In section 4, we present our proposed construction DWCDM+ which is structurally identical to 1K-DWCDM, mentioned in [8], but extends the domain of the nonce to allow nonces up to (n − 1) bits. We used a different name here to explicitly indicate the domain extension of the nonce space.…”

Section: Introductionmentioning

confidence: 99%

“…We begin with presenting an attack in the case when the nonce space is n, depicting that having n − 1 bit nonce space is optimal. This attack was also presented in [8]. Next, we state the nonce respecting and nonce misuse security of DWCDM+ and an instantiation of DWCDM+ with Polyhash function, which we refer as nPolyMAC+.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

<inline-formula><tex-math id="M1">\begin{document}$\textsf{DWCDM+}$\end{document}</tex-math></inline-formula>: A BBB secure nonce based MAC

Datta¹,

Dutta²,

Nandi³

et al. 2019

Advances in Mathematics of Communications

Self Cite

View full text Add to dashboard Cite

In CRYPTO 2016, Cogliati and Seurin have proposed a noncebased MAC called Encrypted Wegman-Carter with Davies-Meyer (EWCDM), from an n-bit block cipher E and an n-bit almost xor universal hash function H as E K 2 E K 1 (N) ⊕ N ⊕ H K h (M) , for a nonce N and a message M that provides roughly 2n/3-bit MAC security. However, obtaining the similar security using a single block cipher key was posed as an open research problem. In this paper, we present Decrypted Wegman-Carter with Davies-Meyer (DWCDM+) construction based on a single block cipher key that provides 2n/3-bit MAC security from an n-bit block cipher E and an n-bit k-regular (∀k ≤ n), almost xor universal hash function H as E −1 K E K (N) ⊕ N ⊕ H K h (M). DWCDM+ is structurally very similar to its predecessor EWCDM except that the facts that (i) the number of block cipher keys reduced from 2 to 1 and (ii) the outer encryption call is replaced by a decryption one. To make the construction truely single-keyed, here we derive the hash key K h as the block cipher output of a fixed string 0 n−2 10 as long as the hash key is of n bits. We show that if the nonce space is restricted to (n − 1) bits, DWCDM+ is secured roughly up to 2 2n/3 MAC queries (2 n/2 MAC queries) and 2 n verification queries against nonce respecting (nonce misuse resp.) adversaries.

show abstract

Section: Introductionmentioning

confidence: 99%