--- res: bibo_abstract: - 'NMAC is a mode of operation which turns a fixed input-length keyed hash function f into a variable input-length function. A practical single-key variant of NMAC called HMAC is a very popular and widely deployed message authentication code (MAC). Security proofs and attacks for NMAC can typically be lifted to HMAC. NMAC was introduced by Bellare, Canetti and Krawczyk [Crypto''96], who proved it to be a secure pseudorandom function (PRF), and thus also a MAC, assuming that (1) f is a PRF and (2) the function we get when cascading f is weakly collision-resistant. Unfortunately, HMAC is typically instantiated with cryptographic hash functions like MD5 or SHA-1 for which (2) has been found to be wrong. To restore the provable guarantees for NMAC, Bellare [Crypto''06] showed its security based solely on the assumption that f is a PRF, albeit via a non-uniform reduction. - Our first contribution is a simpler and uniform proof for this fact: If f is an ε-secure PRF (against q queries) and a δ-non-adaptively secure PRF (against q queries), then NMAC f is an (ε+ℓqδ)-secure PRF against q queries of length at most ℓ blocks each. - We then show that this ε+ℓqδ bound is basically tight. For the most interesting case where ℓqδ ≥ ε we prove this by constructing an f for which an attack with advantage ℓqδ exists. This also violates the bound O(ℓε) on the PRF-security of NMAC recently claimed by Koblitz and Menezes. - Finally, we analyze the PRF-security of a modification of NMAC called NI [An and Bellare, Crypto''99] that differs mainly by using a compression function with an additional keying input. This avoids the constant rekeying on multi-block messages in NMAC and allows for a security proof starting by the standard switch from a PRF to a random function, followed by an information-theoretic analysis. We carry out such an analysis, obtaining a tight ℓq2/2 c bound for this step, improving over the trivial bound of ℓ2q2/2c. The proof borrows combinatorial techniques originally developed for proving the security of CBC-MAC [Bellare et al., Crypto''05].@eng' bibo_authorlist: - foaf_Person: foaf_givenName: Peter foaf_name: Gazi, Peter foaf_surname: Gazi foaf_workInfoHomepage: http://www.librecat.org/personId=3E0BFE38-F248-11E8-B48F-1D18A9856A87 - foaf_Person: foaf_givenName: Krzysztof Z foaf_name: Pietrzak, Krzysztof Z foaf_surname: Pietrzak foaf_workInfoHomepage: http://www.librecat.org/personId=3E04A7AA-F248-11E8-B48F-1D18A9856A87 orcid: 0000-0002-9139-1654 - foaf_Person: foaf_givenName: Michal foaf_name: Rybar, Michal foaf_surname: Rybar foaf_workInfoHomepage: http://www.librecat.org/personId=2B3E3DE8-F248-11E8-B48F-1D18A9856A87 bibo_doi: 10.1007/978-3-662-44371-2_7 bibo_issue: '1' bibo_volume: 8616 dct_date: 2014^xs_gYear dct_language: eng dct_publisher: Springer@ dct_title: The exact PRF-security of NMAC and HMAC@ ...