3 research outputs found
On the Security of NMAC and Its Variants
Based on the three earlier MAC (Message Authentication Code) construction approaches, we propose and analyze some variants of NMAC. We propose some key recovery attacks to these NMAC variants, for example, we can recover the equivalent inner key of NMAC in about O(2n/2) MAC operations, in a related key setting. We propose NMAC-E, a variant of NMAC with secret envelop, to achieve more process efficiency and no loss of security, which needs only one call to the underlying hash function, instead of two invocations in HMAC
On the Security of NMAC and Its Variants
We first propose a general equivalent key recovery attack to a -MAC
variant NMAC, which is also provable secure, by applying a generalized birthday attack. Our
result shows that NMAC, even instantiated with a secure Merkle-Damgård hash function, is
not secure. We further show that this equivalent key recovery attack to NMAC
is also applicable to NMAC for recovering the equivalent inner key of NMAC, in a related key
setting. We propose and analyze a series of NMAC variants with different secret approaches and
key distributions, we find that a variant NMAC-E, with secret envelop approach, can withstand
most of the known attacks in this paper. However, all variants including NMAC itself, are vulnerable
to on-line birthday attack for verifiable forgery. Hence, the underlying cryptographic hash functions,
based on Merkle-Damgård construction, should be re-evaluated seriously
Breaking -MAC Using Birthday Paradox
-MAC was proposed to increase efficiency over HMAC by omitting its outer key, and keep the advantage and security of HMAC at the same time. However, as pointed out by the designer, the security of -MAC also depends on the secrecy of the intermediate value (the equivalent key) of the inner hashing. In this paper, we propose an efficient method to break -MAC, by using a generalized birthday attack to recover the equivalent key, under the assumption that the underlying hash function is secure (weak collision resistance). We can successfully recover the equivalent key of -MAC in about on-line MAC queries and off-line MAC computations with great probability. Moreover, we can improve the attack efficiency by reducing the on-line MAC queries, which can\u27t be done concurrently. This attack shows that the security of -MAC is totally dependent on the (weak) collision resistance of the underlying hash function, instead of the PRF-AX of the underlying compression function in the origin security proof of -MAC