A Tight Bound for EMAC - CWI

sending, together with their message M, the authentication tag CBCE(K,.)(M). On the Security of CBC based MACs. The CBC-MAC as just described
is well known to be completely insecure in general, 2 but has been proven secure
(under the assumption that the underlying block-cipher is a secure pseudorandom
permutation) under the restriction that all messages have the same length
in [BKR00], which then has been relaxed to the condition that no message is the
prefix of another [PR00]. This means that the CBC-MAC can be safely used for
messages of different length, if some prefix free encoding is applied.
The EMAC is a popular variant of the CBC-MAC which was developed by the
RACE project [BP95], unlike the “plain” CBC-MAC it is secure without any
restriction on the message space [PR00]. The EMAC, along with the UMAC,
TTMAC and HMAC, is one of the message authentication codes recommended
by NESSIE [NES].
The Model. As nowadays usual, we analyse the security of the construction we
are interested in (which is ECBCπ1,π2) in a setting where the underlying primitive
(here π1,π2) are realized by their ideal functionality (here uniformly random
permutations), thus separating the analysis of the security of the construction
from the security of the underlying primitive. 3 More precisely, we prove an upper
bound on AdvECBC(q, n, ℓ), by which we denote probability of any adversary
making q queries of length at most ℓ blocks, in (existentially) forging ECBCπ1,π2.
Following [BR00,BPR05], we view the EMAC as a Carter-Wegman MAC
[CW79]. This reduces the task of bounding AdvECBC(q, n, ℓ) to the task of
bounding the probability that there is a collision amongst the CBC-MACs of
q messages of length at most ℓ blocks, we denote this probability by CPq,n,ℓ
(see (5)). In practice one would instantiate the πi’s by a block-cipher (and not
with uniform random permutations). If this block-cipher is secure in the sense
of being a good pseudorandom permutation, then the security of the EMAC is
basically CPq,n,ℓ, thus proving a good bound on this probability translates into
improved security guarantees for the EMAC.
Known Lower Bounds. There is a trivial lower bound CPq,n,ℓ ∈ Ω(q2 /2n )
for any q, n and ℓ>1 as by the birthday bound we can find a collision with
probability Ω(q2 /2n ) for any input shrinking function by asking random queries. 4
For q = 2 [BPR05] show a lower bound of CP2,n,ℓ ∈ Ω(d(ℓ)/2n )where
d(ℓ) def
= maxt≤ℓ |{x;1≤ x ≤ 2n ,x|t}| denotes the maximum number of divisors
between 1 and 2n of any number ≤ ℓ. It is known (Theorem 317 in [HW80])
that D(ℓ) def
= maxt≤ℓ |{x; x|t}| ∈ ℓΘ(1/ ln ln ℓ) , so the same bound applies for d(ℓ)
if ℓ ≤ 2n as then d(ℓ) =D(ℓ).
2 In particular, it is not existentially unforgeable as shown by the following simple
attack: for any X ∈{0, 1} n ,requesttheMACC = CBCπ(X) =π(X), and output
a message XX ⊕ C with tag C. This is a successful forgery as CBCπ(XX ⊕ C) =
π(π(X) ⊕ X ⊕ C) =π(X) =C.
3 See e.g. [Mau02] for more detailed discussion of this concept.
4 For ℓ =1wehaveCPq,n,ℓ = 0 as a permutation does not have collisions.