Quantum Security of NMAC and Related Constructions

Abstract

We prove the security of NMAC, HMAC, AMAC, and the cascade construction with fixed input-length as quantum-secure pseudorandom functions (PRFs). Namely, they are indistinguishable from a random oracle against any polynomial-time quantum adversary that can make quantum superposition queries. In contrast, many blockcipherbased PRFs including CBC-MAC were recently broken by quantum superposition attacks. Classical proof strategies for these constructions do not generalize to the quantum setting, and we observe that they sometimes even fail completely (e.g., the universal-hash then PRF paradigm for proving security of NMAC). Instead, we propose a direct hybrid argument as a new proof strategy (both classically and quantumly). We first show that a quantumsecure PRF is secure against key-recovery attacks, and remains secure under random leakage of the key. Next, as a key technical tool, we extend the oracle indistinguishability framework of Zhandry in two directions: we consider distributions on functions rather than strings, and we also consider a relative setting, where an additional oracle, possibly correlated with the distributions, is given to the adversary as well. This enables a hybrid argument to prove the security of NMAC. Security proofs for other constructions follow similarly.

General Linear Group Action on Tensors: A Candidate for Post-quantum Cryptography

“…Proof. The proof is essentially identical to that of Zhandry [Zha12] or Song and Yun [SY17]; since f is secure as a PRF, it is also oracle-secure. This allows the same hybrid argument in the security proof for GGM in [Zha12], or the security proof for the cascade construction in [SY17].…”

“…Then, the security of f is in fact equivalent to indistinguishability of D 0 and D 1 relative to the simple oracle H. Again according to [SY17], when two function distributions are indistinguishable relative to H, then they are oracle-indistinguishable relative to H. We can also observe that this is equivalent to the oracle security of f defined as above.…”

“…Let f : P × K × X → Y be a PRF. We say that f is oracle-secure with respect to an index set I, if for any quantum polynomial-time adversary A which can make quantum superposition queries to its oracle, we have the following: And, as in [SY17], we show that if a PRF with a public key is secure, then it is also oracle-secure.…”

“…In fact, the above is the same as the cascade construction for the one-bit PRF f . When we instantiate the GGM construction using an ordinary PRG, or when we instantiate the cascade construction using an ordinary PRF (without the public-key part), the quantum security is already established [Zha12,SY17]. The only difference is that here we instantiate the construction using a keyed PRG, or, equivalently, a one-bit PRF with a public key.…”

“…Following [Zha12] or [SY17], we can define a version of oracle security for such a PRF with a public key.…”