bachelor

3.2 Attacking the MAC 33
Card 1 Card 2 Card 3 Card 4
2 56 MAC batch 2 40 MAC batch 2 24 MAC batch 2 8 MAC batch 1
Figure 3.7: Description of usage of the “MAC batch” function that takes a piece
of data with a valid MAC and calculates MACs for all the key candidates from
the list it receives. The numbers on the arrows are the expected cardinality of
the keyset given to the batch function.
tables for the corresponding MACs it is possible to take the intersection the n
tables to “weed out” all the key prospects that do not appear in all the lists.
Generally, the more space and CPU time the attacker can afford, the more
effective this improvement is.
It is possible to make some statistical analysis as to how much an increase in
rainbow tables would affect calculation time, but in general one table should be
enough; starting with a keyspace of 2 56 and reducing that to about 2 56−16 =
2 40 to be brute-forced, it will take 1.2 days for a modern computer 6 for the
intersection set, see 3.2.7.1. If the intersection is ambiguous the remaining
intersection sets can be done in seconds.
We can define a function taking some list of keys and using this list to calculate
the reduced MACs for a given data element. This data element should already
have a MAC that is issued by the system. If the reduced MAC matches the
one already in the data element, it means that the current key is a candidate,
and the key is saved in a buffer of key candidates. This buffer is then given
as input to the same function acting on another card’s data. This way the key
candidates can be weeded out effectively. This model is shown on Figure 3.7.
3.2.4.2 Accomodating this limitation by obtaining more chosen plaintext
from the same card
It is also possible to obtain more chosen plaintext by simply changing the value
of some fields on the card and record the MACs of these individual samples. If
one can find a sector that can mutate to four or more different controlled states,
then it is possible to have 4 · 16 = 64 bits of independent MAC data for some
key. This is convenient, as we shall see in section 3.2.7.
6 In this case, a Lenovo laptop with an Intel Core 2 Duo processor at 2.26GHz, using one
CPU thread.