On the Influence of Message Length in PMAC’s Security Bounds

Abstract

Abstract. Many MAC (Message Authentication Code) algorithms have security bounds which degrade linearly with the message length. Often there are attacks that confirm the linear dependence on the message length, yet PMAC has remained without attacks. Our results show that PMAC's message length dependence in security bounds is non-trivial. We start by studying a generalization of PMAC in order to focus on PMAC's basic structure. By abstracting away details, we are able to show that there are two possibilities: either there are infinitely many instantiations of generic PMAC with security bounds independent of the message length, or finding an attack against generic PMAC which establishes message length dependence is computationally hard. The latter statement relies on a conjecture on the difficulty of finding subsets of a finite field summing to zero or satisfying a binary quadratic form. Using the insights gained from studying PMAC's basic structure, we then shift our attention to the original instantiation of PMAC, namely, with Gray codes. Despite the initial results on generic PMAC, we show that PMAC with Gray codes is one of the more insecure instantiations of PMAC, by illustrating an attack which roughly establishes a linear dependence on the message length.

The Exact Security of PMAC

“…Recently, Luykx et al [LPSY16] showed that one can construct a pair of messages which will collide with probability roughly /2 n , leading to an attack with advantage /2 n for q = 2 messages. However, their attack does not generalize to q messages.…”

“…, γ to contain a large coset of a subgroup of GF (2 n ), and it's not clear if the sequence from [Rog04] contains such a set. Let us mention that for similar reasons the attack from [LPSY16] does not apply to the [Rog04] construction either.…”

A simple authentication encryption scheme

“…[16][17][18] All the objects are defined as "Thing" such as smart-phones, smart-cars, industrial sensors, actuators, household appliances, and grid-networking under the platform of data and network communications. [10][11][12][13][19][20][21] Interestingly, the major works are focused to build network and topology for the concept of IoT. 12,13,[19][20][21] The IoT is already starting to kick-out to the applications of real-world: From home to office via car, smart-phone, health-card, national-card, and bank-card.…”

“…12,13,[19][20][21] The IoT is already starting to kick-out to the applications of real-world: From home to office via car, smart-phone, health-card, national-card, and bank-card. [10][11][12][13][19][20][21] Interestingly, the major works are focused to build network and topology for the concept of IoT. Therefore, a blackhole is developing for the emerging concept of the IoT, where the blackhole means lack of security, lack of trust, lack of integrity, lack of privacy under the communication channels.…”

“…[3][4][5] Hence, the solution is to improvise a scheme of message authentication encryption. [6][7][8][9][10][11] Simple concept of authentication encryption (AE) including MAC. Let a sender () and receiver () work under the communication network of   .…”