Abstract:In this paper we study the security of hash-based MAC algorithms (such as HMAC and NMAC) above the birthday bound. Up to the birthday bound, HMAC and NMAC are proven to be secure under reasonable assumptions on the hash function. On the other hand, if an n-bit MAC is built from a hash function with a l-bit state (l >= n), there is a well-known existential forgery attack with complexity 2(l/2). However, the remaining security after 2(l/2) computations is not well understood. In particular it is widely assumed that if the underlying hash function is sound, then a generic universal forgery attack should require 2(n) computations and some distinguishing (e.g. distinguishing-H but not distinguishing-R) and state-recovery attacks should also require 2(l) computations (or 2(k) if k < l).In this work, we show that above the birthday bound, hash-based MACs offer significantly less security than previously believed. Our main result is a generic distinguishing-H and state-recovery attack against hash-based MACs with a complexity of only <(O)over tilde> (2(l/2)). In addition, we show a key-recovery attack with complexity (O) over tilde (2(3l/4)) against HMAC used with a hash functions with an internal checksum, such as GOST. This surprising result shows that the use of a checksum might actually weaken a hash function when used in a MAC. We stress that our attacks are generic, and they are in fact more efficient than some previous attacks proposed on MACs instanciated with concrete hash functions. We use techniques similar to the cycle-detection technique proposed by Peyrin et al. at Asiacrypt 2012 to attack HMAC in the related-key model. However, our attacks works in the single-key model for both HMAC and NMAC, and without restriction on the key size.

Generic Related-Key Attacks For Hmac

Updates on Generic Attacks against HMAC and NMAC.

New Generic Attacks Against Hash-Based MACs.

Generic Universal Forgery Attack on Iterative Hash-based MACs.

Generic Attacks on Strengthened HMAC: n-bit Secure HMAC Requires Key in All Blocks.

Generic Internal State Recovery on Strengthened HMAC: N -Bit Secure HMAC Requires Key in All Blocks.

Cryptanalysis On Hmac/Nmac-Md5 And Md5-Mac

New Key-Recovery Attacks On Hmac/Nmac-Md4 And Nmac-Md5

Generic State-Recovery and Forgery Attacks on ChopMD-MAC and on NMAC/HMAC

Improved Single-Key Distinguisher On Hmac-Md5 And Key Recovery Attacks On Sandwich-Mac-Md5

Cryptanalysis of HMAC/NMAC-Whirlpool.

Improved Single-Key Distinguisher on HMAC-MD5 and Key Recovery Attacks on Sandwich-MAC-MD5 and MD5-MAC

Full Key-Recovery Attack on the HMAC/NMAC Based on 3 and 4-Pass HAVAL

Equivalent Key Recovery Attacks Against Hmac and Nmac with Whirlpool Reduced to 7 Rounds

Differential and Correlation Power Analysis Attacks on HMAC-Whirlpool

Second Preimage Attack on 5-Pass HAVAL and Partial Key-Recovery Attack on HMAC/NMAC-5-Pass HAVAL

Near-Collision Attacks on MD4: Applied to MD4-Based Protocols.

A First-Order Differential Power Analysis Attack on Hmac-Sm3

A Chosen - Plaintext Differential Power Analysis Attack on HMAC - SM3.

Distinguishing Attack on the Secret-Prefix MAC Based on the 39-Step SHA-256