A variant of poly1305 MAC and its security proof

Dayin Wang,Dongdai Lin,Wenling Wu

DOI: https://doi.org/10.1007/11596981_55

2005-01-01

Abstract:We give a variant of Poly1305 MAC and prove its security viewing this MAC as a Carter-Wegman MAC. The proposed variant not only keeps all the good properties of the Poly1305, but also makes Poly1305 deterministic.

What problem does this paper attempt to address?

An Improved Poly1305 Mac

Dayin Wang,Dongdai Lin,Wenling Wu

DOI: https://doi.org/10.1007/11767480_19

2006-01-01

Abstract:In this paper, we propose an improved Poly1305 MAC, called IPMAC. IPMAC is a refinement of Poly1305 MAC shown by Bernstein. We use only one 16-byte key and one 16-byte nonce for IPMAC while Poly1305 MAC uses two 16-byte keys and one 16-byte nonce, 48-byte in total. The cost of reducing the size of secret keys is almost negligible: only one encryption. Similarly to Poly1305 MAC, our algorithm correctly and efficiently handles messages of arbitrary bit length.
OPMAC: one-key poly1305 MAC

Dayin Wang,Dongdai Lin,Wenling Wu

DOI: https://doi.org/10.1007/11937807_7

2006-01-01

Abstract:In this paper, we present One-Key Poly1305 MAC(OPMAC) and prove its security for arbitrary length message. OPMAC is deterministic and takes only one 16-byte key. Previously, Poly1305 MAC is nonce-based and requires two 16-byte keys and a 16-byte nonce, 48-byte in total.
Forgery Attacks on Several Beyond-Birthday-Bound Secure MACs

Yaobin Shen,Francois-Xavier Standaert,Lei Wang

DOI: https://doi.org/10.1007/978-981-99-8727-6_6

2023-01-01

Abstract:At CRYPTO'18, Datta et al. proposed nPolyMAC and proved the security up to 2(2n/3) authentication queries and 2(n) verification queries. At EUROCRYPT'19, Dutta et al. proposed CWC+ and showed the security up to 2(2n/3) queries. At FSE'19, Datta et al. proposed PolyMAC and its key-reduced variant 2k-PolyMAC, and showed the security up to 2(2n/3) queries. This security bound was then improved by Kim et al. (EUROCRYPT'20) and Datta et al. (FSE'23) respectively to 2(3n/4) and in the multi-user setting. At FSE'20, Chakraborti et al. proposed PDM*MAC and 1k-PDM*MAC, and showed the security up to 2(2n/3) queries. Recently, Chen et al. proposed nEHtM(p)(+) and showed the security up to 2(2n/3) queries. In this paper, we show forgery attacks on nPolyMAC, CWC+, PolyMAC, 2k-PolyMAC, PDM* MAC, 1k-PDM*MAC and nEHtM(p)(+). Our attacks exploit some vulnerability in the underlying polynomial hash function Poly, and (i) require only one authentication query and one verification query; (ii) are nonce-respecting; (iii) succeed with probability 1. Thus, our attacks disprove the provable high security claims of these schemes. We then revisit their security analyses and identify what went wrong. Finally, we propose two solutions that can restore the beyond-birthday-bound security.
Another Look at PMAC.

Dayin Wang,Dongdai Lin,Wenling Wu

2007-01-01

Abstract:We can view an existing Message Authentication Code (MAC) as a Carter-Wegman MAC in spite of the fact it may not have been designed as one. This will make the analysis easier than it has been when considered from other viewpoints. In this paper, we can look PMAC with two keys as a Carter-Wegman MAC and get a simple security proof for it. Using this viewpoint to look at PMAC, we will learn not only why the PMAC is such constructed, but also a new method of constructing MACs.
A New Message Authentication Code and Its Security Proof

WANG Da-yin,LIN Dong-dai,WU Wen-ling

DOI: https://doi.org/10.3321/j.issn:0372-2112.2006.10.014

2006-01-01

Abstract:The most important tool to protect data integrity is Message Authentication Code(MAC),which is widely used in many kinds of secure systems.With the development of the theory of provable security,the MACs,which have security proof,are the first choice of many people.Based on the constructions of XOR MAC and PMAC,we define a deterministic fully parallelizable block-cipher mode of operation for message authentication-DXOR MAC(Deterministic XOR MAC).We prove its security,quantifying an adversary's forgery probability in terms of the quality of the block cipher as a pseudo-random permutation.
An Efficient Privacy-Preserving Scheme for Wireless Link Layer Security

Yanfei Fan,Bin Lin,Yixin Jiang,Xuemin (Sherman) Shen

DOI: https://doi.org/10.1109/glocom.2008.ecp.891

2008-01-01

Abstract:In this paper, we propose an efficient privacy-preserving scheme for secure packet transmission at wireless link layer. The proposed scheme is constructed by using hash values in reverse hash chains as interface identifiers. It can successfully and efficiently resist the Media Access Control (MAC) address based attacks, such as flow tracking and traffic analysis, which are launched by either outside or even inside attackers. In addition, some optimization techniques are also introduced to further improve the efficiency of the proposed scheme. The extensive analysis and simulations demonstrate the enhanced security and efficiency of the proposed scheme.
Improved Single-Key Distinguisher On Hmac-Md5 And Key Recovery Attacks On Sandwich-Mac-Md5

Yu Sasaki,Lei Wang

DOI: https://doi.org/10.1007/978-3-662-43414-7_25

2014-01-01

Abstract:This paper presents key recovery attacks on Sandwich-MAC instantiating MD5, where Sandwich-MAC is an improved variant of HMAC and achieves the same provable security level and better performance especially for short messages. The increased interest in lightweight cryptography motivates us to analyze such a MAC scheme. We first improve a distinguishing-H attack on HMAC-MD5 proposed by Wang et al. We then propose key recovery attacks on Sandwich-MAC-MD5 by combining various techniques such as distinguishing-H for HMAC-MD5, IV Bridge for APOP, dBB-near-collisions for related-key NMAC-MD5, meet-in-the-middle attack etc. In particular, we generalize a previous key-recovery technique as a new tool exploiting a conditional key-dependent distribution. Our attack also improves the partial-key (K-1) recovery on MD5-MAC, and extends it to recover both K-1 and K-2.
Improved Single-Key Distinguisher on HMAC-MD5 and Key Recovery Attacks on Sandwich-MAC-MD5 and MD5-MAC

Yu Sasaki,Gaoli Wang,Lei Wang

DOI: https://doi.org/10.1587/transfun.e98.a.26

2015-01-01

Abstract:This paper presents key recovery attacks on SandwichMAC instantiating MD5, where Sandwich-MAC is an improved variant of HMAC and achieves the same provable security level and better performance especially for short messages. The increased interest in lightweight cryptography motivates us to analyze such a MAC scheme. Our attacks are based on a distinguishing-H attack on HMAC-MD5 proposed by Wang et al. We first improve its complexity from 2(97) to 2(89.04). With this improvement, we then propose key recovery attacks on Sandwich-MAC-MD5 by combining various techniques such as distinguishing-H for HMAC-MD5, IV Bridge for APOP, dBB-near-collisions for related-key NMAC-MD5, meet-in-the-middle attack etc. In particular, we generalize a previous keyrecovery technique as a new tool exploiting a conditional key-dependent distribution. Surprisingly, a key which is even longer than the tag size can be recovered without the knowledge of the key size. Finally, our attack also improves the previous partial-key (K1) recovery on MD5-MAC, and extends it to recover both of K-1 and K-2.
On the Security of Encrypt-and-MAC Paradigm

Hu Zhenyu,Lin Dongdai,Wu Wenling,Feng Dengguo

IF: 1.019

2007-01-01

Chinese Journal of Electronics

Abstract:A security notion of Message authentication (MAC) named Tag-secrecy was abstracted from the pseudo-randomness of tagging algorithm, to characterize the security that is very different from the unforgeability (which is the traditional security notion of MAC). The Tag-secrecy is weaker than the pseudo-randomness and can be met by widely used authentication schemes. Under the assumption of Tag-secrecy, it is showed that the Encryptand-MAC can preserve Indistinguishability under Chosen-plaintext attacks (IND-CPA) and Integrity of Plaintext (INT-PTXT) in general.A security notion of encryption called Un-trivial forgeability of Ciphertext (UTF-CTXT) was presented to characterize that for any given ciphertext C, the adversary cannot forge a new ciphertext C' to decrypt to the same plaintext as C (named trivial forgery). This UTF-CTXT was to guarantee that any modification about the ciphertext must correspond to some change of the plaintext. It is proved to be much weaker than Integrity of Ciphertext (INT-CTXT) and satisfied by many popular encryption schemes and modes.With a Tag-secrecy MAC and an UTF-CTXT-secure encryption, Encrypt-and-MAC can satisfy the both strongest security requirements-Indistinguishability under Chosen-ciphertext attacks (IND-CCA) and INT-CTXT.
A New Security Analysis for XOR Message Authentication Code

WANG Da-Yin,LIN Dong-Dai,WU Wen-ling,JIANG Zhong-Hua

DOI: https://doi.org/10.3969/j.issn.1002-1175.2006.02.017

2006-01-01

Abstract:Message Authentication Codes are very important tools to protect data integrity.XOR-MAC is defined by Bellare,who also gives a security analysis for it.But the security analysis they gave for XOR-MAC is complex.In this paper,we use the Game-Playing technique to give a new security analysis for XOR-MAC.We prove XOR-MAC secure,quantifying an adversary's success probability of distinguishing XOR-MAC from a purely random function in terms of the quality of the block cipher as a pseudorandom permutation.
A PUF-based provably secure message authentication algorithm and application

Xiaolin Zhang,Dawu Gu

DOI: https://doi.org/10.1360/ssi-2021-0261

2021-01-01

Scientia Sinica Informationis

Abstract:Message authentication code (MAC), widely used in all kinds of information systems, is a symmetric cryptographic algorithm that checks message integrity and source authenticity. However, when the devices running MAC face physical invasion, the attacker can extract the keys inside and generate valid tags by directly reading the memory or adjusting the circuits. In this paper, we propose PUF-MAC, a new MAC algorithm based on the physically unclonable function (PUF), which is constructed from the hash function and PUF. The PUF is a kind of data mapping entity with unclonable internal structures and unpredictable outputs. The difference between mappings preserved by PUF entities originates from minor variations in the physical environment during production. The communicating parties can apply the PUF to form the shared secret key. Under the standard security model, this paper inductively proves that PUF-MAC satisfies the existential unforgeability under a chosen message attack, and the EUF-CMA security of PUF-MAC relies on the (weak) collision resistance of hash and the EUF-CMA security of PUF. Additionally, this paper recasts PUF-MAC into a key agreement protocol with forward/backward security, along with a bilateral authentication protocol by which its practicability is indicated. A comparison with other MAC reveals that PUF-MAC is indeed lightweight and easy to deploy, and PUF-MAC requires no pre-established PUF responses. The involvement of the PUF allows an attacker to forge a valid tag even after retrieving the key, thereby ensuring communication security.
LedMAC: More Efficient Variants of LightMAC.

Yaobin Shen,Lei Wang,Dawu Gu

2021-01-01

Abstract:LightMAC is a lightweight MAC designed by Luykx et al. and recently standardized by ISO/IEC. In this paper, we refine LightMAC and suggest two simple variants called LedMAC1 and LedMAC2. Compared to LightMAC, our first scheme LedMAC1 avoids unnecessary padding without sacrificing the security. Our second scheme LedMAC2 further reduces the number of keys from two to one, and achieves the same level security as that of LightMAC.
Generic State-Recovery and Forgery Attacks on ChopMD-MAC and on NMAC/HMAC

Yusuke Naito,Yu Sasaki,Lei Wang,Kan Yasuda

DOI: https://doi.org/10.1007/978-3-642-41383-4_6

2013-01-01

Abstract:This paper presents new attacks on message authentication codes (MACs). Our attacks are generic and applicable to (secret-prefix) ChopMD-MAC and to NMAC/HMAC, all of which are based on a Merkle-Damgård hash function. We show that an internal state value of these MACs can be recovered with time/queries less than O(2 n )—roughly, with an O(2 n /n) complexity, where ChopMD has 2n-bit state and NMAC/HMAC n-bit. We also show that state-recovery can be extended to MAC-security compromise, such as almost universal forgeries and distinguishing-H attacks. While our results remain to be of theoretical interest due to the high attack complexity, they lead to profound consequences. Namely, our analyses provide us with proper understanding of these MAC constructions, for in the literature the complexity has been implicitly and explicitly assumed to be O(2 n ). Since the complexity is very close to 2 n , we make a precise calculation of attack complexities and of success probabilities in order to show that the total complexity is indeed less than 2 n . Moreover, we perform an experiment by computer simulation to demonstrate that our calculation is correct.
New Distinguishing Attack on MAC Using Secret-Prefix Method

Xiaoyun Wang,Wei Wang,Keting Jia,Meiqin Wang

DOI: https://doi.org/10.1007/978-3-642-03317-9_22

2009-01-01

Abstract:This paper presents a new distinguisher which can be applied to secret-prefix MACs with the message length prepended to the message before hashing. The new distinguisher makes use of a special truncated differential path with high probability to distinguish an inner near-collision in the first round. Once the inner near-collision is detected, we can recognize an instantiated MAC from a MAC with a random function. The complexity for distinguishing the MAC with 43-step reduced SHA-1 is 2124.5 queries. For the MAC with 61-step SHA-1, the complexity is 2154.5 queries. The success probability is 0.70 for both.
A Parallelizable Message Authentication Code

WANG Da-Yin,LIN Dong-Dai,WU Wen-Ling

DOI: https://doi.org/10.1360/jos181756

2007-01-01

Journal of Software

Abstract:This paper defines and analyzes a fully deterministic parallelizable block-cipher mode of operation for message authentication— DPMAC (deterministic parallelizable message authentication code). DPMAC is constructed based on a 128-bit block cipher, works for strings of any bit length, and employs a single block-cipher key. Its security is proved, using the Game-Playing technique to quantify an adversary's forgery probability in terms of the quality of the block cipher as a pseudo-random permutation.
Cryptanalysis On Hmac/Nmac-Md5 And Md5-Mac

Xiaoyun Wang,Hongbo Yu,Wei Wang,Haina Zhang,Tao Zhan

DOI: https://doi.org/10.1007/978-3-642-01001-9_7

2009-01-01

Abstract:In this paper, we present the first distinguishing attack on HMAC and NMAC based on MD5 without related keys, which distinguishes the HMAC/NMAC-MD5 from HMAC/NMAC with a random function. The attack needs 2(97) queries, with a success probability 0.87, while the previous distinguishing attack on HMAC-MD5 reduced to 33 rounds takes 2(126.1) messages with a success rate of 0.92. Furthermore, we give distinguishing and partial key recovery attacks on MDx-MAC based on MD5. The MDx-MAC was proposed by Preneel and van Oorschot in Crypto'95 which uses three subkeys derived from the initial key. We are able to recover one 128-bit subkey with 2(97) queries.
Revisiting The Security Of Dbhts Macs: Beyond-Birthday-Bound In The Multi-User Setting

Yaobin Shen,Lei Wang,Dawu Gu,Jian Weng

DOI: https://doi.org/10.1007/978-3-030-84252-9_11

2021-01-01

Abstract:Double-block Hash-then-Sum (DbHtS) MACs are a class of MACs that aim for achieving beyond-birthday-bound security, including SUM-ECBC, PMAC Plus, 3kf9 and LightMAC Plus. Recently Datta et al. (FSE'19), and then Kim et al. (Eurocrypt'20) prove that DbHtS constructions are secure beyond the birthday bound in the single-user setting. However, by a generic reduction, their results degrade to (or even worse than) the birthday bound in the multi-user setting.In this work, we revisit the security of DbHtS MACs in the multi-user setting. We propose a generic framework to prove beyond-birthday-bound security for DbHtS constructions. We demonstrate the usability of this framework with applications to key-reduced variants of DbHtS MACs, including 2k-SUM-ECBC, 2k-PMAC_Plus and 2k-LightMAC_Plus. Our results show that the security of these constructions will not degrade as the number of users grows. On the other hand, our results also indicate that these constructions are secure beyond the birthday bound in both single-user and multi-user setting without additional domain separation, which is used in the prior work to simplify the analysis.Moreover, we find a critical flaw in 2kf9, which is proved to be secure beyond the birthday bound by Datta et al. (FSE'19). We can successfully forge a tag with probability 1 without making any queries. We go further to show attacks with birthday-bound complexity on several variants of 2kf9.
On Beyond-Birthday-Bound Security: Revisiting the Development of ISO/IEC 9797-1 MACs

Yaobin Shen,Lei Wang

DOI: https://doi.org/10.46586/tosc.v2019.i2.146-168

2019-01-01

Abstract:ISO/IEC 9797-1 is an international standard for block-cipher-based Message Authentication Code (MAC). The current version ISO/IEC 9797-1:2011 specifies six single-pass CBC-like MAC structures that are capped at the birthday bound security. For a higher security that is beyond-birthday bound, it recommends to use the concatenation combiner of two single-pass MACs. In this paper, we reveal the invalidity of the suggestion, by presenting a birthday bound forgery attack on the concatenation combiner, which is essentially based on Joux’s multi-collision. Notably, our new forgery attack for the concatenation of two MAC Algorithm 1 with padding scheme 2 only requires 3 queries. Moreover, we look for patches by revisiting the development of ISO/IEC 9797-1 with respect to the beyond-birthday bound security. More specifically, we evaluate the XOR combiner of single-pass CBC-like MACs, which was used in previous version of ISO/IEC 9797-1.
Security Analysis of a Path Validation Scheme with Constant-Size Proof

Yangyang Wu,Changsong Jiang,Chunxiang Xu,Kefei Chen

DOI: https://doi.org/10.1109/tifs.2021.3101043

IF: 7.231

2021-01-01

IEEE Transactions on Information Forensics and Security

Abstract:We analyze a path validation scheme with constant-size proof (published in IEEE Transactions on Information Forensics and Security) and demonstrate that this scheme fails to achieve unforgeability. An adversary can forge a valid proof with a non-negligible probability.
Distinguishing and Second-Preimage Attacks on CBC-Like MACs

Keting Jia,Xiaoyun Wang,Zheng Yuan,Guangwu Xu

DOI: https://doi.org/10.1007/978-3-642-10433-6_23

2009-01-01

Abstract:This paper first presents a new distinguishing attack on the CBC-MAC structure based on block ciphers in cipher block chaining (CBC) mode. This attack detects a CBC-like MAC from random functions. The second result of this paper is a second-preimage attack on the CBC-MAC, which is an extension of the attack of Brincat and Mitchell. The attack also covers MT-MAC, PMAC and MACs with three-key enciphered CBC mode. Instead of exhaustive search, both types of attacks are of birthday attack complexity.

A variant of poly1305 MAC and its security proof

An Improved Poly1305 Mac

OPMAC: one-key poly1305 MAC

Forgery Attacks on Several Beyond-Birthday-Bound Secure MACs

Another Look at PMAC.

A New Message Authentication Code and Its Security Proof

An Efficient Privacy-Preserving Scheme for Wireless Link Layer Security

Improved Single-Key Distinguisher On Hmac-Md5 And Key Recovery Attacks On Sandwich-Mac-Md5

Improved Single-Key Distinguisher on HMAC-MD5 and Key Recovery Attacks on Sandwich-MAC-MD5 and MD5-MAC

On the Security of Encrypt-and-MAC Paradigm

A New Security Analysis for XOR Message Authentication Code

A PUF-based provably secure message authentication algorithm and application

LedMAC: More Efficient Variants of LightMAC.

Generic State-Recovery and Forgery Attacks on ChopMD-MAC and on NMAC/HMAC

New Distinguishing Attack on MAC Using Secret-Prefix Method

A Parallelizable Message Authentication Code

Cryptanalysis On Hmac/Nmac-Md5 And Md5-Mac

Revisiting The Security Of Dbhts Macs: Beyond-Birthday-Bound In The Multi-User Setting

On Beyond-Birthday-Bound Security: Revisiting the Development of ISO/IEC 9797-1 MACs

Security Analysis of a Path Validation Scheme with Constant-Size Proof

Distinguishing and Second-Preimage Attacks on CBC-Like MACs