报告题目: |
New Generic attacks on Hash-based MACs |
报告人: |
Dr. Gaëtan Leurent |
|
Université Catholique de Louvain, Belgique
|
报告时间: |
2013-09-02 10:15 |
报告地点: |
Conference Hall 322, Science Building, Tsinghua University |
主办单位: |
高等研究院 |
简介: |
In this talk we study the security of hash-based MAC algorithms
(such as HMAC and NMAC) above the birthday bound. Up to the
birthday bound, HMAC and NMAC are proven to be secure under
reasonable assumptions on the hash function. On the other hand, if
an n-bit MAC is built from a hash function with a l-bit state
(l > n), there is a well-known existential forgery attack with
complexity 2^l/2. However, the remaining security after
2^l/2 computations is not well understood. In particular it is
widely assumed that if the underlying hash function is sound,
then a generic universal forgery attack should still require 2^n
computations and some distinguishing (e.g. distinguishing-H
but not distinguishing-R) and state-recovery attacks should still
require 2^l computations.
In this work, we show that above the birthday bound, hash-based MACs
offer significantly less security than previously believed. Our
main result is a generic distinguishing-H and state-recovery attack
against hash-based MACs with a complexity of only 2^l/2. In
addition, we show a key-recovery attack with complexity 2^3l/4
against HMAC used with a hash functions with an internal checksum, such as GOST.
This surprising result shows that the use of a checksum might actually
weaken a hash function when used in a MAC.
|
|
