Generic Attacks against Beyond-Birthday-Bound MACs Gatan Leurent 1 , - - PowerPoint PPT Presentation

▶
generic attacks against beyond birthday bound macs
SMART_READER_LITE
LIVE PREVIEW

Generic Attacks against Beyond-Birthday-Bound MACs Gatan Leurent 1 , - - PowerPoint PPT Presentation

Mar 27, 2024 362 likes •1.05k views

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion Generic Attacks against Beyond-Birthday-Bound MACs Gatan Leurent 1 , Mridul Nandi 2 , Ferdinand Sibleyras 1 1 Inria quipe SECRET, Paris, France 2 Indian

slide-1
SLIDE 1

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Generic Attacks against Beyond-Birthday-Bound MACs

Gaëtan Leurent1, Mridul Nandi2, Ferdinand Sibleyras1

1 Inria équipe SECRET, Paris, France 2 Indian Statistical Institute, Kolkata, India

GT SECRET

1 / 30

slide-2
SLIDE 2

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Introduction

  • Symmetric cryptography: Alice and Bob share the same key.
  • Active attacker: Eve might intercept and manipulate

Alice’s messages...

  • Authentication: Alice computes and appends

a keyed MAC or tag T.

Plz come back!||T

Correct tag. Will read.

2 / 30

slide-3
SLIDE 3

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

ECBC-MAC

m1 Ek1 m2 Ek1

  • • •

mℓ−1 Ek1 mℓ Ek1 Ek2 Σ(m) MAC(m) The plaintext m is padded and split into n-bit blocks. MAC(m) = Ek2

  • Σ(m)
  • Alice sends MAC(m) along with m to guarantee authenticity.

3 / 30

slide-4
SLIDE 4

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Introduction

  • Verifying: Bob verifies the tag with the shared key and
  • nly reads the message if it is correct.
  • Forgery: Eve cannot modify the message without forging

a new and correct tag.

Plz come back!||T P l z s t a y a w a y ! | | T

Incorrect tag. Won’t read.

4 / 30

slide-5
SLIDE 5

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Introduction

  • Verifying: Bob verifies the tag with the shared key and
  • nly reads the message if it is correct.
  • Forgery: Eve cannot modify the message without forging

a new and correct tag.

Plz come back!||T P l z s t a y a w a y ! | | T

Incorrect tag. Won’t read. Direct attacks won’t work but is it secure? Can Eve still mount an attack?

4 / 30

slide-6
SLIDE 6

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

A security game

5 / 30

slide-7
SLIDE 7

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

A security game

m MAC(m)

5 / 30

slide-8
SLIDE 8

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

A security game

m MAC(m) m||T Valid/Invalid

5 / 30

slide-9
SLIDE 9

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

A security game

m MAC(m) m||T Valid/Invalid qt = the number

  • f tagging queries.

5 / 30

slide-10
SLIDE 10

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

A security game

m MAC(m) m||T Valid/Invalid qt = the number

  • f tagging queries.

qv = the number of verification queries.

5 / 30

slide-11
SLIDE 11

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

A security game

m MAC(m) m||T Valid/Invalid qt = the number

  • f tagging queries.

qv = the number of verification queries. Can Eve forge a valid tag for a message that Alice never saw?

5 / 30

slide-12
SLIDE 12

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Case of ECBC

Properties of ECBC for all messages m, m′, c: MAC(m) = MAC(m′) = ⇒ Ek2

  • Σ(m)
  • =Ek2
  • Σ(m′)
  • =

⇒ Σ(m) =Σ(m′) = ⇒ Σ(m||c) =Σ(m′||c) = ⇒ MAC(m||c) = MAC(m′||c) ECBC mode m1 Ek1 m2 Ek1 ... mℓ Ek1 Ek2 Σ(m) MAC(m)

6 / 30

slide-13
SLIDE 13

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Case of ECBC

Properties of ECBC for all messages m, m′, c: MAC(m) = MAC(m′) = ⇒ Ek2

  • Σ(m)
  • =Ek2
  • Σ(m′)
  • =

⇒ Σ(m) =Σ(m′) = ⇒ Σ(m||c) =Σ(m′||c) = ⇒ MAC(m||c) = MAC(m′||c) ECBC mode m1 Ek1 m2 Ek1 ... mℓ Ek1 Ek2 Σ(m) MAC(m) Simple collision approach Look for a pair of messages X,Y that satisfies: Σ(X) = Σ(Y ) ⇐ ⇒ MAC(X) ⊕ MAC(Y ) = 0

6 / 30

slide-14
SLIDE 14

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Birthday Bound Attack

Eve Alice

m1 m2 m3 m4 m5 m6

MAC(m1) MAC(m2) MAC(m3) ... Looking for collisions Eve looks for MAC(mi) = MAC(mj) for some i = j. She has ≃ q2

t pairs for an n-bit relationship so chances grow as:

Adv(A) ≃ q2

t

2n

7 / 30

slide-15
SLIDE 15

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Forgery from collisions

Expansion property MAC(m) = MAC(m′) = ⇒ MAC(m||c) = MAC(m′||c) ∀c Collision found: MAC(You must) = MAC(No, don’t)

Can you come back?||T0

8 / 30

slide-16
SLIDE 16

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Forgery from collisions

Expansion property MAC(m) = MAC(m′) = ⇒ MAC(m||c) = MAC(m′||c) ∀c Collision found: MAC(You must) = MAC(No, don’t)

Can you come back?||T0

Correct tag. Will read.

8 / 30

slide-17
SLIDE 17

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Forgery from collisions

Expansion property MAC(m) = MAC(m′) = ⇒ MAC(m||c) = MAC(m′||c) ∀c Collision found: MAC(You must) = MAC(No, don’t) Tell Bob he must come back! Oh you are right!

8 / 30

slide-18
SLIDE 18

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Forgery from collisions

Expansion property MAC(m) = MAC(m′) = ⇒ MAC(m||c) = MAC(m′||c) ∀c Collision found: MAC(You must) = MAC(No, don’t)

You must come back!||T

8 / 30

slide-19
SLIDE 19

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Forgery from collisions

Expansion property MAC(m) = MAC(m′) = ⇒ MAC(m||c) = MAC(m′||c) ∀c Collision found: MAC(You must) = MAC(No, don’t)

You must come back!||T N

  • ,

d

  • n

’ t c

  • m

e b a c k ! | | T

Correct tag. Will read.

8 / 30

slide-20
SLIDE 20

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Forgery from collisions

Expansion property MAC(m) = MAC(m′) = ⇒ MAC(m||c) = MAC(m′||c) ∀c Collision found: MAC(You must) = MAC(No, don’t)

You must come back!||T N

  • ,

d

  • n

’ t c

  • m

e b a c k ! | | T

Correct tag. Will read. Forgery requires qt ≃ 2n/2 and qv = 1. Not secure beyond birthday bound (2n/2)

8 / 30

slide-21
SLIDE 21

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Going beyond

Problem How to build a deterministic MAC scheme secure when qt > 2n/2? Not so easy: This birthday bound attack is generic to all deterministic iterated MAC constructions with an n-bit internal state [Preneel, van Oorschot, CRYPTO’95].

9 / 30

slide-22
SLIDE 22

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Going beyond

Problem How to build a deterministic MAC scheme secure when qt > 2n/2? Not so easy: This birthday bound attack is generic to all deterministic iterated MAC constructions with an n-bit internal state [Preneel, van Oorschot, CRYPTO’95]. Idea: Double the size of the internal state to 2n bits. Double-Block-Hash-Then-Sum Approach XOR the two half-states at the end to recover an n-bit MAC. Important research effort exploring this idea including: SUM-ECBC, PMAC+, 3kf9, LightMAC+, GCM-SIV2, 1kPMAC+

9 / 30

slide-23
SLIDE 23

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Example: SUM-ECBC [Yasuda; CT-RSA’10]

m1 Ek1 m1 Ek3 m2 Ek1 m2 Ek3 mℓ−1 Ek1 ... mℓ−1 Ek3 ... mℓ Ek1 mℓ Ek3 Ek2 Ek4 MAC(m) Σ(m) Θ(m) MAC(m) = Ek2

  • Σ(m)
  • ⊕ Ek4
  • Θ(m)
  • 10 / 30
slide-24
SLIDE 24

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

This paper

Problem Many of those schemes are proven secure when qt < 22n/3. What happens when qt ≥ 22n/3? Actual attacks or proof artefact?

11 / 30

slide-25
SLIDE 25

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

This paper

Problem Many of those schemes are proven secure when qt < 22n/3. What happens when qt ≥ 22n/3? Actual attacks or proof artefact? Results A generic approach leading to an attack on all cited schemes using qv = 1 and qt ≃ 23n/4.

11 / 30

slide-26
SLIDE 26

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

4-way collision for double-hash-then-sum schemes

Look for a quadruple of messages X, Y , Z, T that satisfies: R(X, Y , Z, T) :=            Σ(X) = Σ(Y ) Θ(Y ) = Θ(Z) Σ(Z) = Σ(T) Θ(T) = Θ(X) R(X, Y , Z, T) = ⇒ MAC(X)⊕MAC(Y )⊕MAC(Z)⊕MAC(T) = 0 MAC(X) = E(Σ(X)) ⊕ E ′(Θ(X)) E ′(Θ(T)) ⊕ E(Σ(T)) = MAC(T) MAC(Y ) = E(Σ(Y )) ⊕ E ′(Θ(Y )) E ′(Θ(Z)) ⊕ E(Σ(Z)) = MAC(Z) = = = =

12 / 30

slide-27
SLIDE 27

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

4-way collision for double-hash-then-sum schemes

With carefully crafted sets of messages for X, Y , Z, T:      Σ(X) = Σ(Y ) Θ(Y ) = Θ(Z) Σ(Z) = Σ(T) = ⇒ Θ(T) = Θ(X). Thus R(X, Y , Z, T) ⇐ ⇒      Σ(X) = Σ(Y ) Θ(Y ) = Θ(Z) Σ(Z) = Σ(T) a 3n-bit condition.

13 / 30

slide-28
SLIDE 28

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

4-way collision for double-hash-then-sum schemes

With carefully crafted sets of messages for X, Y , Z, T:      Σ(X) = Σ(Y ) Θ(Y ) = Θ(Z) Σ(Z) = Σ(T) = ⇒ Θ(T) = Θ(X). Thus R(X, Y , Z, T) ⇐ ⇒      Σ(X) = Σ(Y ) Θ(Y ) = Θ(Z) Σ(Z) = Σ(T) a 3n-bit condition. Query complexity There are ≃ q4

t quadruples for a 3n-bit condition.

A good one with high probability after qt ≃ 23n/4 queries.

13 / 30

slide-29
SLIDE 29

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Attack on SUM-ECBC

m1 Ek1 m1 Ek3 m2 Ek1 m2 Ek3 mℓ−1 Ek1 ... mℓ−1 Ek3 ... mℓ Ek1 mℓ Ek3 Ek2 Ek4 MAC(m) Σ(m) Θ(m) MAC(m) = Ek2

  • Σ(m)
  • ⊕ Ek4
  • Θ(m)
  • 14 / 30
slide-30
SLIDE 30

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Crafting the messages

X = 0||x; Y = 1||y; Z = 0||z; T = 1||t;

15 / 30

slide-31
SLIDE 31

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Crafting the messages

X = 0||x; Y = 1||y; Z = 0||z; T = 1||t; R :=            Σ(X) = Σ(Y ) Θ(Y ) = Θ(Z) Σ(Z) = Σ(T) Θ(T) = Θ(X) ⇐ ⇒            Ek1(x ⊕ Ek1(0)) = Ek1(y ⊕ Ek1(1)) Ek3(y ⊕ Ek3(1)) = Ek3(z ⊕ Ek3(0)) Ek1(z ⊕ Ek1(0)) = Ek1(t ⊕ Ek1(1)) Ek3(t ⊕ Ek3(1)) = Ek3(x ⊕ Ek3(0))

15 / 30

slide-32
SLIDE 32

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Crafting the messages

X = 0||x; Y = 1||y; Z = 0||z; T = 1||t; R :=            Σ(X) = Σ(Y ) Θ(Y ) = Θ(Z) Σ(Z) = Σ(T) Θ(T) = Θ(X) ⇐ ⇒            Ek1(x ⊕ Ek1(0)) = Ek1(y ⊕ Ek1(1)) Ek3(y ⊕ Ek3(1)) = Ek3(z ⊕ Ek3(0)) Ek1(z ⊕ Ek1(0)) = Ek1(t ⊕ Ek1(1)) Ek3(t ⊕ Ek3(1)) = Ek3(x ⊕ Ek3(0)) ⇐ ⇒            x ⊕ Ek1(0) = y ⊕ Ek1(1) y ⊕ Ek3(1) = z ⊕ Ek3(0) z ⊕ Ek1(0) = t ⊕ Ek1(1) t ⊕ Ek3(1) = x ⊕ Ek3(0) ⇐ ⇒      x ⊕ y ⊕ z ⊕ t = 0 x ⊕ y = Ek1(0) ⊕ Ek1(1) x ⊕ t = Ek3(0) ⊕ Ek3(1) R(X, Y , Z, T) is indeed a 3n-bit condition on the quadruple.

15 / 30

slide-33
SLIDE 33

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Filtering quadruples

R ⇐ ⇒      x ⊕ y ⊕ z ⊕ t = 0 x ⊕ y = Ek1(0) ⊕ Ek1(1) x ⊕ t = Ek3(0) ⊕ Ek3(1) Observable Filters The first equation of R in addition to the sum of MACs:

  • x ⊕ y ⊕ z ⊕ t = 0

MAC(0||x) ⊕ MAC(1||y) ⊕ MAC(0||z) ⊕ MAC(1||t) = 0

16 / 30

slide-34
SLIDE 34

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Filtering quadruples

R ⇐ ⇒      x ⊕ y ⊕ z ⊕ t = 0 x ⊕ y = Ek1(0) ⊕ Ek1(1) x ⊕ t = Ek3(0) ⊕ Ek3(1) Observable Filters The first equation of R in addition to the sum of MACs:

  • x ⊕ y ⊕ z ⊕ t = 0

MAC(0||x) ⊕ MAC(1||y) ⊕ MAC(0||z) ⊕ MAC(1||t) = 0 Not enough It is a 2n-bit filter for q4

t ≃ 23n quadruples.

2n quadruples to randomly pass the filter for only 1 respecting R.

16 / 30

slide-35
SLIDE 35

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Amplifying the filter

R

  • (0||x), (1||y), (0||z), (1||t)
  • ⇐

⇒      x ⊕ y ⊕ z ⊕ t = 0 x ⊕ y = Ek1(0) ⊕ Ek1(1) x ⊕ t = Ek3(0) ⊕ Ek3(1) R ⇐ ⇒      (x ⊕ 1) ⊕ (y ⊕ 1) ⊕ (z ⊕ 1) ⊕ (t ⊕ 1) = 0 (x ⊕ 1) ⊕ (y ⊕ 1) = Ek1(0) ⊕ Ek1(1) (x ⊕ 1) ⊕ (t ⊕ 1) = Ek3(0) ⊕ Ek3(1)

17 / 30

slide-36
SLIDE 36

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Amplifying the filter

R

  • (0||x), (1||y), (0||z), (1||t)
  • ⇐

⇒      x ⊕ y ⊕ z ⊕ t = 0 x ⊕ y = Ek1(0) ⊕ Ek1(1) x ⊕ t = Ek3(0) ⊕ Ek3(1) R ⇐ ⇒      (x ⊕ 1) ⊕ (y ⊕ 1) ⊕ (z ⊕ 1) ⊕ (t ⊕ 1) = 0 (x ⊕ 1) ⊕ (y ⊕ 1) = Ek1(0) ⊕ Ek1(1) (x ⊕ 1) ⊕ (t ⊕ 1) = Ek3(0) ⊕ Ek3(1) Related solutions R

  • (0||x), (1||y), (0||z), (1||t)
  • ⇐

⇒ R

  • (0||x ⊕ 1), (1||y ⊕ 1), (0||z ⊕ 1), (1||t ⊕ 1)
  • In particular if we have a good solution x, y, z, t then it verifies:

MAC(0||x ⊕1)⊕MAC(1||y ⊕1)⊕MAC(0||z ⊕1)⊕MAC(1||t⊕1) = 0

17 / 30

slide-37
SLIDE 37

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Finding a good quadruple

Find a quadruple (x, y, z, t) such that:

x ⊕ y ⊕ z ⊕ t = 0 MAC(0||x) ⊕ MAC(1||y) ⊕ MAC(0||z) ⊕ MAC(1||t) = 0 MAC(0||x ⊕ 1) ⊕ MAC(1||y ⊕ 1) ⊕ MAC(0||z ⊕ 1) ⊕ MAC(1||t ⊕ 1) = 0

18 / 30

slide-38
SLIDE 38

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Finding a good quadruple

Find a quadruple (x, y, z, t) such that:

x ⊕ y ⊕ z ⊕ t = 0 MAC(0||x) ⊕ MAC(1||y) ⊕ MAC(0||z) ⊕ MAC(1||t) = 0 MAC(0||x ⊕ 1) ⊕ MAC(1||y ⊕ 1) ⊕ MAC(0||z ⊕ 1) ⊕ MAC(1||t ⊕ 1) = 0

  • 1. Query and build the following 4 lists of size 23n/4:

L1 = {x|| MAC(0||x)|| MAC(0||x ⊕ 1)} L2 = {y|| MAC(1||y)|| MAC(1||y ⊕ 1)} L3 = {z|| MAC(0||z)|| MAC(0||z ⊕ 1)} L4 = {t|| MAC(1||t)|| MAC(1||t ⊕ 1)}

18 / 30

slide-39
SLIDE 39

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Finding a good quadruple

Find a quadruple (x, y, z, t) such that:

x ⊕ y ⊕ z ⊕ t = 0 MAC(0||x) ⊕ MAC(1||y) ⊕ MAC(0||z) ⊕ MAC(1||t) = 0 MAC(0||x ⊕ 1) ⊕ MAC(1||y ⊕ 1) ⊕ MAC(0||z ⊕ 1) ⊕ MAC(1||t ⊕ 1) = 0

  • 1. Query and build the following 4 lists of size 23n/4:

L1 = {x|| MAC(0||x)|| MAC(0||x ⊕ 1)} L2 = {y|| MAC(1||y)|| MAC(1||y ⊕ 1)} L3 = {z|| MAC(0||z)|| MAC(0||z ⊕ 1)} L4 = {t|| MAC(1||t)|| MAC(1||t ⊕ 1)}

  • 2. Find ℓ1, ℓ2, ℓ3, ℓ4 in L1, L2, L3, L4 respectively

such that ℓ1 ⊕ ℓ2 ⊕ ℓ3 ⊕ ℓ4 = 0.

18 / 30

slide-40
SLIDE 40

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Finding a good quadruple

  • 1. Query and build L1, L2, L3, L4 of size 23n/4.
  • 2. Find ℓ1, ℓ2, ℓ3, ℓ4 in L1, L2, L3, L4 respectively

such that ℓ1 ⊕ ℓ2 ⊕ ℓ3 ⊕ ℓ4 = 0. Algorithm cost Step 1 costs qt = O(23n/4) queries and as much memory. Step 2 is about solving an instance of the 4-XOR problem. Solve it in O(23n/4) memory and O(23n/2) time.

19 / 30

slide-41
SLIDE 41

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Optimizing time complexity

SUM-ECBC and GCM-SIV2: optimize the time complexity at the cost of queries.

20 / 30

slide-42
SLIDE 42

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Optimizing time complexity

SUM-ECBC and GCM-SIV2: optimize the time complexity at the cost of queries. Related solutions R

  • (0||x), (1||y), (0||z), (1||t)
  • ⇐

⇒ R

  • (0||x ⊕ c), (1||y ⊕ c), (0||z ⊕ c), (1||t ⊕ c)
  • ∀c

So R = ⇒ ∀c : MAC(0||x⊕c)⊕MAC(1||y ⊕c)⊕MAC(0||z⊕c)⊕MAC(1||t⊕c) = 0

20 / 30

slide-43
SLIDE 43

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Optimizing time complexity

Let C = {c : c < 23n/7} we sum the relations:

                  MAC(0||x ⊕ 0) ⊕ MAC(1||y ⊕ 0) ⊕ MAC(0||z ⊕ 0) ⊕ MAC(1||t ⊕ 0) = 0 MAC(0||x ⊕ 1) ⊕ MAC(1||y ⊕ 1) ⊕ MAC(0||z ⊕ 1) ⊕ MAC(1||t ⊕ 1) = 0 MAC(0||x ⊕ 2) ⊕ MAC(1||y ⊕ 2) ⊕ MAC(0||z ⊕ 2) ⊕ MAC(1||t ⊕ 2) = 0 MAC(0||x ⊕ 3) ⊕ MAC(1||y ⊕ 3) ⊕ MAC(0||z ⊕ 3) ⊕ MAC(1||t ⊕ 3) = 0 MAC(0||x ⊕ 4) ⊕ MAC(1||y ⊕ 4) ⊕ MAC(0||z ⊕ 4) ⊕ MAC(1||t ⊕ 4) = 0 ...

21 / 30

slide-44
SLIDE 44

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Optimizing time complexity

Let C = {c : c < 23n/7} we sum the relations:

  • c∈C

MAC(0||x ⊕ c) ⊕ MAC(1||y ⊕ c) ⊕ MAC(0||z ⊕ c) ⊕ MAC(1||t ⊕ c) = 0

21 / 30

slide-45
SLIDE 45

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Optimizing time complexity

Let C = {c : c < 23n/7} we sum the relations:

  • c∈C

MAC(0||x⊕c) ⊕

  • c∈C

MAC(1||y⊕c) ⊕

  • c∈C

MAC(0||z⊕c) ⊕

  • c∈C

MAC(1||t⊕c) = 0

21 / 30

slide-46
SLIDE 46

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Optimizing time complexity

Let C = {c : c < 23n/7} we sum the relations:

  • c∈C

MAC(0||x⊕c) ⊕

  • c∈C

MAC(1||y⊕c) ⊕

  • c∈C

MAC(0||z⊕c) ⊕

  • c∈C

MAC(1||t⊕c) = 0

Only the most significant 4n/7 bits of x, y, z, t are meaningful and must respect a 3 · 4n/7 = 12n/7-bit relationship.

21 / 30

slide-47
SLIDE 47

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Optimizing time complexity

Let C = {c : c < 23n/7} we sum the relations:

  • c∈C

MAC(0||x⊕c) ⊕

  • c∈C

MAC(1||y⊕c) ⊕

  • c∈C

MAC(0||z⊕c) ⊕

  • c∈C

MAC(1||t⊕c) = 0

Only the most significant 4n/7 bits of x, y, z, t are meaningful and must respect a 3 · 4n/7 = 12n/7-bit relationship. L1 =

  • x[3n/7:n]||
  • c∈C

MAC(0||x ⊕ c)||

  • c∈C

MAC(0||(x ⊕ δ) ⊕ c)

  • For |L| = 23n/7 the 4-XOR problem takes O(26n/7) time.

One element requires 23n/7 queries, a total of O(26n/7) queries.

21 / 30

slide-48
SLIDE 48

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Optimizing time complexity

Let C = {c : c < 23n/7} we sum the relations:

  • c∈C

MAC(0||x⊕c) ⊕

  • c∈C

MAC(1||y⊕c) ⊕

  • c∈C

MAC(0||z⊕c) ⊕

  • c∈C

MAC(1||t⊕c) = 0

Only the most significant 4n/7 bits of x, y, z, t are meaningful and must respect a 3 · 4n/7 = 12n/7-bit relationship. L1 =

  • x[3n/7:n]||
  • c∈C

MAC(0||x ⊕ c)||

  • c∈C

MAC(0||(x ⊕ δ) ⊕ c)

  • For |L| = 23n/7 the 4-XOR problem takes O(26n/7) time.

One element requires 23n/7 queries, a total of O(26n/7) queries. Previously we used O(23n/2) time and O(23n/4) queries. Thus this optimization uses less time but more queries.

21 / 30

slide-49
SLIDE 49

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Forgery from quadruples

Σ(m) and Θ(m) are built the same way as simple ECBC’s Σ(m). In particular for all suffixes c: Σ(m) = Σ(m′) = ⇒ Σ(m||c) = Σ(m′||c) The same holds for Θ.

22 / 30

slide-50
SLIDE 50

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Forgery from quadruples

Σ(m) and Θ(m) are built the same way as simple ECBC’s Σ(m). In particular for all suffixes c: Σ(m) = Σ(m′) = ⇒ Σ(m||c) = Σ(m′||c) The same holds for Θ. Expansion property SUM-ECBC R(X, Y , Z, T) = ⇒ R(X||c, Y ||c, Z||c, T||c) ∀c Therefore Eve can forge in a very similar manner.

22 / 30

slide-51
SLIDE 51

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Forgery from quadruples

Expansion property SUM-ECBC (reminder) R(X, Y , Z, T) = ⇒ R(X||c, Y ||c, Z||c, T||c) ∀c Quadruple found: MAC(You should) MAC(Plz help) MAC(You must) MAC(Plz never) T1 T3

You should come back!||T1

Tell Bob he should come back!

23 / 30

slide-52
SLIDE 52

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Forgery from quadruples

Expansion property SUM-ECBC (reminder) R(X, Y , Z, T) = ⇒ R(X||c, Y ||c, Z||c, T||c) ∀c Quadruple found: MAC(You should) MAC(Plz help) MAC(You must) MAC(Plz never) T1 T3

You should come back!||T1

Correct tag. Will read.

23 / 30

slide-53
SLIDE 53

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Forgery from quadruples

Expansion property SUM-ECBC (reminder) R(X, Y , Z, T) = ⇒ R(X||c, Y ||c, Z||c, T||c) ∀c Quadruple found: MAC(You should) MAC(Plz help) MAC(You must) MAC(Plz never) T1, T2 T3

Plz help come back!||T2

Plz help tell Bob to come back!

23 / 30

slide-54
SLIDE 54

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Forgery from quadruples

Expansion property SUM-ECBC (reminder) R(X, Y , Z, T) = ⇒ R(X||c, Y ||c, Z||c, T||c) ∀c Quadruple found: MAC(You should) MAC(Plz help) MAC(You must) MAC(Plz never) T1, T2 T3

Plz help come back!||T2

Correct tag. Will read.

23 / 30

slide-55
SLIDE 55

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Forgery from quadruples

Expansion property SUM-ECBC (reminder) R(X, Y , Z, T) = ⇒ R(X||c, Y ||c, Z||c, T||c) ∀c Quadruple found: MAC(You should) MAC(Plz help) MAC(You must) MAC(Plz never) T1, T2, T3 T4 = T1 ⊕ T2 ⊕ T3

You must come back!||T3

Tell Bob he must come back!

23 / 30

slide-56
SLIDE 56

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Forgery from quadruples

Expansion property SUM-ECBC (reminder) R(X, Y , Z, T) = ⇒ R(X||c, Y ||c, Z||c, T||c) ∀c Quadruple found: MAC(You should) MAC(Plz help) MAC(You must) MAC(Plz never) T1, T2, T3 T4 = T1 ⊕ T2 ⊕ T3

You must come back!||T3 P l z n e v e r c

  • m

e b a c k ! | | T4

Correct tag. Will read.

23 / 30

slide-57
SLIDE 57

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Conclusion

Main results:

  • Most of our attacks use 23n/4 queries and 23n/2 time.
  • Variant for SUM-ECBC & GCM-SIV2: 26n/7 queries and time.

24 / 30

slide-58
SLIDE 58

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

3kf9[Zhang, Wu, Sui, Wang; AC’12]

m1 E1 m2 E1 mℓ−1 E1 ... ... mℓ E1 E3 E2 Σ Θ MAC(m)

Figure: Diagram for 3kf9 with an ℓ−block message.

25 / 30

slide-59
SLIDE 59

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

1kf9[Datta, Dutta, Nandi, Paul, Zhang; 2015, withdrawn’17]

E m1 E mℓ−1 E ... ... mℓ E Σ′ Θ′ 2 fix0 fix1 E E MAC(m) Σ Θ

26 / 30

slide-60
SLIDE 60

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

1kf9[Datta, Dutta, Nandi, Paul, Zhang; 2015, withdrawn’17]

E m1 E mℓ−1 E ... ... mℓ E Σ′ Θ′ 2 fix0 fix1 E E MAC(m) Σ Θ R(X, Y ) :=

  • Σ′(X) = Σ′(Y )

2Θ′(X) = 2Θ′(Y ) ⊕ 1 = ⇒

  • Σ(X) = Σ(Y )

Θ(X) = Θ(Y )

26 / 30

slide-61
SLIDE 61

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Crafting the messages

X = x||0; Y = y||d; where d = 2−1

27 / 30

slide-62
SLIDE 62

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Crafting the messages

X = x||0; Y = y||d; where d = 2−1 R(X, Y ) ⇐ ⇒

  • E
  • 0 ⊕ E(x ⊕ E(0))
  • = E
  • E(y ⊕ E(0)) ⊕ d
  • Θ′(X) = Θ′(Y ) ⊕ d

27 / 30

slide-63
SLIDE 63

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Crafting the messages

X = x||0; Y = y||d; where d = 2−1 R(X, Y ) ⇐ ⇒

  • E
  • 0 ⊕ E(x ⊕ E(0))
  • = E
  • E(y ⊕ E(0)) ⊕ d
  • Θ′(X) = Θ′(Y ) ⊕ d

⇔

  • E
  • x ⊕ E(0)
  • = E
  • y ⊕ E(0)
  • ⊕ d

E(0) ⊕ E

  • x ⊕ E(0)
  • ⊕ Σ′(X) = E(0) ⊕ E
  • y ⊕ E(0)
  • ⊕ Σ′(Y ) ⊕ d

27 / 30

slide-64
SLIDE 64

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Crafting the messages

X = x||0; Y = y||d; where d = 2−1 R(X, Y ) ⇐ ⇒

  • E
  • 0 ⊕ E(x ⊕ E(0))
  • = E
  • E(y ⊕ E(0)) ⊕ d
  • Θ′(X) = Θ′(Y ) ⊕ d

⇔

  • E
  • x ⊕ E(0)
  • = E
  • y ⊕ E(0)
  • ⊕ d

E(0) ⊕ E

  • x ⊕ E(0)
  • ⊕ Σ′(X) = E(0) ⊕ E
  • y ⊕ E(0)
  • ⊕ Σ′(Y ) ⊕ d

⇐ ⇒

  • E
  • x ⊕ E(0)
  • = E
  • y ⊕ E(0)
  • ⊕ d

E

  • x ⊕ E(0)
  • = E
  • y ⊕ E(0)
  • ⊕ d

⇐ ⇒ Σ′(X) = Σ′(Y ) R(X, Y ) is an n-bit relation on a couple: Birthday Bound! Look for collision MAC(X) = MAC(Y ).

27 / 30

slide-65
SLIDE 65

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Discussion

Easy forge after found collision: Expansion property 1kf9 R(X, Y ) = ⇒ R(X||c, Y ||c) ∀c Different multiplications can’t help: Full collision on Σ′ Set d := inverse of the Θ′ multiplication.

28 / 30

slide-66
SLIDE 66

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Conclusion

Main results:

  • Most of our attacks use 23n/4 queries and 23n/2 time.
  • Variant for SUM-ECBC & GCM-SIV2: 26n/7 queries and time.

Additionally:

  • Withdrawn 1kf9 shown to allow Birthday Bound Attacks and

therefore is not a BBB scheme.

  • Recent results on security of LightMAC+ [Naito, CT-RSA’18]

proved wrong by our attack.

29 / 30

slide-67
SLIDE 67

Introduction Birthday Bound Attack Beyond Birthday Bound SUM-ECBC 1kf9 Conclusion

Conclusion

Attacks (this work) Mode Queries Time Type SUM-ECBC O(23n/4) ˜ O(23n/2) Universal O(26n/7) ˜ O(26n/7) Universal GCM-SIV2 O(23n/4) ˜ O(23n/2) Universal O(26n/7) ˜ O(26n/7) Universal PMAC+ O(23n/4) ˜ O(23n/2) Existential LightMAC+ O(23n/4) ˜ O(23n/2) Existential 1kPMAC+ O(23n/4) ˜ O(23n/2) Existential 3kf9 O( 4 √n · 23n/4) ˜ O(25n/4) Universal 1kf9 O(2n/2) ˜ O(2n/2) Universal Except 1kf9, all above schemes have a proof that they are secure while qt < 22n/3. We showed they are not secure when qt ≥ 23n/4. Open question: What happens when 22n/3 ≤ qt < 23n/4 ?

30 / 30