Generic Attacks Against Beyond-Birthday-Bound MACs

Abstract

In this work, we study the security of several recent MAC constructions with provable security beyond the birthday bound. We consider block-cipher based constructions with a double-block internal state, such as SUM-ECBC, PMAC+, 3kf9, GCM-SIV2, and some variants (LightMAC+, 1kPMAC+). All these MACs have a security proof up to 2 2n/3 queries, but there are no known attacks with less than 2 n queries. We describe a new cryptanalysis technique for double-block MACs based on finding quadruples of messages with four pairwise collisions in halves of the state. We show how to detect such quadruples in SUM-ECBC, PMAC+, 3kf9, GCM-SIV2 and their variants with O(2 3n/4) queries, and how to build a forgery attack with the same query complexity. The time complexity of these attacks is above 2 n , but it shows that the schemes do not reach full security in the information theoretic model. Surprisingly, our attack on LightMAC+ also invalidates a recent security proof by Naito. Moreover, we give a variant of the attack against SUM-ECBC and GCM-SIV2 with time and data complexityÕ(2 6n/7). As far as we know, this is the first attack with complexity below 2 n against a deterministic beyondbirthday-bound secure MAC. As a side result, we also give a birthday attack against 1kf9, a single-key variant of 3kf9 that was withdrawn due to issues with the proof.

Double-block Hash-then-Sum: A Paradigm for Constructing BBB Secure PRF

“…Open Problem II: In a very recent work of Leurent et al [LNS18], SUM-ECBC, PMAC_Plus, 3kf9, LightMAC_Plus and their reduced keyed-variant have been attacked with the query complexity 2 3n/4 . We believe that all these constructions can also be proven secured upto 2 3n/4 , and hence establishing the tightness of the bound.…”

“…Very recently, Leurent et al [LNS18] have shown attacks on all these constructions with 2 3n/4 query complexity. This raises an interesting future problem to study the tightness of PRF security of these constructions.…”

Towards Closing the Security Gap of Tweak-aNd-Tweak (TNT)

“…We do not claim that our observations are novel. Instead, both are applications of [LNS18] and [Men18]. The latter, however, is an information-theoretic distinguisher that uses O( √ n • 2 3n/4 ) queries, but the description by Mennink demands O(2 3n/2 ) offline operations to identify the required pairs.…”

Highly Secure Nonce-based MACs from the Sum of Tweakable Block Ciphers

“…Datta et al [DDNP18] coined the term Double-Block Hash-then-Sum (DbHtS) for this approach in general. Leurent et al [LNS18] proposed generic attacks on DbHtS constructions with a query complexity of O(2 3n/4 ). Very recently, Kim et al [KLL20] showed that the bound of O(2 3n/4 ) queries for DbHtS MACs is tight.…”

“…Note that we considered only constructions based on tweakable block ciphers. For example, while the DbHtS constructions [LNS18] are comparable in structure, they are built from classical block ciphers. Since those are weaker primitives, comparing with those constructions would be unfair to our advantage.…”