Tight Security Analysis of EHtM MAC

Authors

  • Avijit Dutta Applied Statistics Unit, Indian Statistical Institute, Kolkata, India
  • Ashwin Jha Applied Statistics Unit, Indian Statistical Institute, Kolkata, India
  • Mridul Nandi Applied Statistics Unit, Indian Statistical Institute, Kolkata, India

DOI:

https://doi.org/10.13154/tosc.v2017.i3.130-150

Keywords:

Probabilistic MAC, EHtM, XMACR

Abstract

The security of a probabilistic Message Authentication Code (MAC) usually depends on the uniqueness of the random salt which restricts the security to birthday bound of the salt size due to the collision on random salts (e.g XMACR). To overcome the birthday bound limit, the natural approach to use (a) either a larger random salt (e.g MACRX3 uses 3n bits of random salt where n is the input and output size of the underlying non-compressing pseudorandom function or PRF) or (b) a PRF with increased domain size (e.g RWMAC or Randomized WMAC). Enhanced Hashthen- Mask (EHtM), proposed by Minematsu in FSE 2010, is the first probabilistic MAC scheme that provides beyond birthday bound security without increasing the randomness of the salt and the domain size of the non-compressing PRF. The author proved the security of EHtM as long as the number of MAC query is smaller than 22n/3 where n is the input size of the underlying non-compressing PRF. In this paper, we provide the exact security bound of EHtM and prove that this construction offers security up to 23n/4 MAC queries. The exactness is shown by demonstrating a matching attack.

Published

2017-09-19

Issue

Section

Articles

How to Cite

Tight Security Analysis of EHtM MAC. (2017). IACR Transactions on Symmetric Cryptology, 2017(3), 130-150. https://doi.org/10.13154/tosc.v2017.i3.130-150