---
OA_place: publisher
_id: '838'
abstract:
- lang: eng
text: 'In this thesis we discuss the exact security of message authentications codes
HMAC , NMAC , and PMAC . NMAC is a mode of operation which turns a fixed input-length
keyed hash function f into a variable input-length function. A practical single-key
variant of NMAC called HMAC is a very popular and widely deployed message authentication
code (MAC). PMAC is a block-cipher based mode of operation, which also happens
to be the most famous fully parallel MAC. NMAC was introduced by Bellare, Canetti
and Krawczyk Crypto’96, who proved it to be a secure pseudorandom function (PRF),
and thus also a MAC, under two assumptions. Unfortunately, for many instantiations
of HMAC one of them has been found to be wrong. To restore the provable guarantees
for NMAC , Bellare [Crypto’06] showed its security without this assumption. PMAC
was introduced by Black and Rogaway at Eurocrypt 2002. If instantiated with a
pseudorandom permutation over n -bit strings, PMAC constitutes a provably secure
variable input-length PRF. For adversaries making q queries, each of length at
most ` (in n -bit blocks), and of total length σ ≤ q` , the original paper proves
an upper bound on the distinguishing advantage of O ( σ 2 / 2 n ), while the currently
best bound is O ( qσ/ 2 n ). In this work we show that this bound is tight by
giving an attack with advantage Ω( q 2 `/ 2 n ). In the PMAC construction one
initially XORs a mask to every message block, where the mask for the i th block
is computed as τ i := γ i · L , where L is a (secret) random value, and γ i is
the i -th codeword of the Gray code. Our attack applies more generally to any
sequence of γ i ’s which contains a large coset of a subgroup of GF (2 n ). As
for NMAC , our first contribution is a simpler and uniform proof: If f is an ε
-secure PRF (against q queries) and a δ - non-adaptively secure PRF (against q
queries), then NMAC f is an ( ε + `qδ )-secure PRF against q queries of length
at most ` blocks each. We also show that this ε + `qδ bound is basically tight
by constructing an f for which an attack with advantage `qδ exists. Moreover,
we analyze the PRF-security of a modification of NMAC called NI by An and Bellare
that avoids the constant rekeying on multi-block messages in NMAC and allows for
an information-theoretic analysis. We carry out such an analysis, obtaining a
tight `q 2 / 2 c bound for this step, improving over the trivial bound of ` 2
q 2 / 2 c . Finally, we investigate, if the security of PMAC can be further improved
by using τ i ’s that are k -wise independent, for k > 1 (the original has k
= 1). We observe that the security of PMAC will not increase in general if k =
2, and then prove that the security increases to O ( q 2 / 2 n ), if the k = 4.
Due to simple extension attacks, this is the best bound one can hope for, using
any distribution on the masks. Whether k = 3 is already sufficient to get this
level of security is left as an open problem. Keywords: Message authentication
codes, Pseudorandom functions, HMAC, PMAC. '
alternative_title:
- ISTA Thesis
article_processing_charge: No
author:
- first_name: Michal
full_name: Rybar, Michal
id: 2B3E3DE8-F248-11E8-B48F-1D18A9856A87
last_name: Rybar
citation:
ama: Rybar M. (The exact security of) Message authentication codes. 2017. doi:10.15479/AT:ISTA:th_828
apa: Rybar, M. (2017). (The exact security of) Message authentication codes.
Institute of Science and Technology Austria. https://doi.org/10.15479/AT:ISTA:th_828
chicago: Rybar, Michal. “(The Exact Security of) Message Authentication Codes.”
Institute of Science and Technology Austria, 2017. https://doi.org/10.15479/AT:ISTA:th_828.
ieee: M. Rybar, “(The exact security of) Message authentication codes,” Institute
of Science and Technology Austria, 2017.
ista: Rybar M. 2017. (The exact security of) Message authentication codes. Institute
of Science and Technology Austria.
mla: Rybar, Michal. (The Exact Security of) Message Authentication Codes.
Institute of Science and Technology Austria, 2017, doi:10.15479/AT:ISTA:th_828.
short: M. Rybar, (The Exact Security of) Message Authentication Codes, Institute
of Science and Technology Austria, 2017.
corr_author: '1'
date_created: 2018-12-11T11:48:46Z
date_published: 2017-06-26T00:00:00Z
date_updated: 2026-04-08T14:18:39Z
day: '26'
ddc:
- '000'
degree_awarded: PhD
department:
- _id: KrPi
doi: 10.15479/AT:ISTA:th_828
file:
- access_level: open_access
checksum: ff8639ec4bded6186f44c7bd3ee26804
content_type: application/pdf
creator: system
date_created: 2018-12-12T10:10:13Z
date_updated: 2020-07-14T12:48:12Z
file_id: '4799'
file_name: IST-2017-828-v1+3_2017_Rybar_thesis.pdf
file_size: 847400
relation: main_file
- access_level: closed
checksum: 3462101745ce8ad199c2d0f75dae4a7e
content_type: application/zip
creator: dernst
date_created: 2019-04-05T08:24:11Z
date_updated: 2020-07-14T12:48:12Z
file_id: '6202'
file_name: 2017_Thesis_Rybar_source.zip
file_size: 26054879
relation: source_file
file_date_updated: 2020-07-14T12:48:12Z
fulldoi: https://doi.org/10.15479/AT:ISTA:th_828
has_accepted_license: '1'
language:
- iso: eng
month: '06'
oa: 1
oa_version: Published Version
page: '86'
publication_identifier:
issn:
- 2663-337X
publication_status: published
publisher: Institute of Science and Technology Austria
publist_id: '6810'
pubrep_id: '828'
related_material:
record:
- id: '2082'
relation: part_of_dissertation
status: public
- id: '6196'
relation: part_of_dissertation
status: public
status: public
title: (The exact security of) Message authentication codes
type: dissertation
user_id: ba8df636-2132-11f1-aed0-ed93e2281fdd
year: '2017'
...