ZMAC+ – An Efficient Variable-output-length Variant of ZMAC


  • Eik List Bauhaus-Universität Weimar, Weimar, Germany
  • Mridul Nandi Indian Statistical Institute, Kolkata, India



Message authentication code, tweakable block cipher, provable security


There is an ongoing trend in the symmetric-key cryptographic community to construct highly secure modes and message authentication codes based on tweakable block ciphers (TBCs). Recent constructions, such as Cogliati et al.’s HaT or Iwata et al.’s ZMAC, employ both the n-bit plaintext and the t-bit tweak simultaneously for higher performance.
This work revisits ZMAC, and proposes a simpler alternative finalization based on HaT. As a result, we propose HtTBC, and call its instantiation with ZHash as a hash function ZMAC+. Compared to HaT, ZMAC+ (1) requires only a single key and a single primitive. Compared to ZMAC, our construction (2) allows variable, per-query parametrizable output lengths. Moreover, ZMAC+ (3) avoids the complex finalization of ZMAC and (4) improves the security bound from Ο(σ2/2n+min(n,t)) to Ο(q/2n + q(q + σ)/2n+min(n,t)) while retaining a practical tweak space.



How to Cite

List, E., & Nandi, M. (2017). ZMAC+ – An Efficient Variable-output-length Variant of ZMAC. IACR Transactions on Symmetric Cryptology, 2017(4), 306–325.