New Generic Attacks against Hash-Based MACs

Abstract

Abstract. In this paper we study the security of hash-based MAC algorithms (such as HMAC and NMAC) above the birthday bound. Up to the birthday bound, HMAC and NMAC are proven to be secure under reasonable assumptions on the hash function. On the other hand, if an n-bit MAC is built from a hash function with a l-bit state (l ≥ n), there is a well-known existential forgery attack with complexity 2 l/2 . However, the remaining security after 2 l/2 computations is not well understood. In particular it is widely assumed that if the underlying hash function is sound, then a generic universal forgery attack should still require 2 n computations and some distinguishing (e.g. distinguishing-H but not distinguishing-R) and state-recovery attacks should still require 2 l (or 2 k if k < l) computations. In this work, we show that above the birthday bound, hash-based MACs offer significantly less security than previously believed. Our main result is a generic distinguishing-H and state-recovery attack against hash-based MACs with a complexity of onlyÕ(2 l/2 ). In addition, we show a key-recovery attack with complexityÕ(2 3l/4 ) against HMAC used with a hash functions with an internal checksum, such as GOST. This surprising result shows that the use of a checksum might actually weaken a hash function when used in a MAC. We stress that our attacks are generic, and they are in fact more efficient than some previous attacks proposed on MACs instantiated with concrete hash functions. We use techniques similar to the cycle-detection technique proposed by Peyrin et al. at Asiacrypt 2012 to attack HMAC in the related-key model. However, our attacks works in the single-key model for both HMAC and NMAC, and without restriction on the key size.

Generic Universal Forgery Attack on Iterative Hash-Based MACs

“…Our universal forgery attack is based on recent advances in hash-based MACs cryptanalysis [17,15] and in this section we quickly recall these methods and explain how we extend them. First of all, we need to introduce the notion of functional graph and the various properties that can be observed from it.…”

“…Later, Leurent et al [15] extended the scope of cycle detection by providing a single-key utilization of this technique. Namely, they show how to craft two special long messages (mainly composed of identical message blocks), both following two separate cycle loops in the functional graph of the internal compression function.…”

“…Moreover, our techniques are novel as they show that one can extract much more meaningful secret information than by just analyzing the cycle structure or the collision probability of the functional graphs of the MAC algorithm, as was done previously [17,15]. Indeed, the distance of a node from the cycle of its components in the functional graph is a very valuable information to know for an attacker, and we expect even more complex types of information to be exploitable by attackers against iterative hash-based MACs.…”

Generic Security of NMAC and HMAC with Input Whitening

“…First, from the security viewpoint, the justification comes from the rich line of research on generic attacks on hash-based MACs. Most recent attacks [20,16,21,11] exploit the so-called "functional graph" of the compression function f, i.e., the graph capturing the structure of f when repeatedly invoked with its b-bit input fixed to some constant (say 0 b ). Since our whitening denies the adversary the knowledge of b-bit inputs on which f is invoked during construction queries, intuitively it seems to be the right way to foil such attacks.…”

“…As mentioned above, the motivation for our work partially stems from the recent line of work on generic attacks against iterated hash-based MACs [20,18,16,21,11,6,23]. While our security bound for WNMAC does not exclude attacks of the complexity (in terms of numbers of queries and message lengths) considered in these papers, the design of WNMAC was partially guided by the structure of these attacks and seems to prevent them.…”