Key recovery attacks on the RMAC, TMAC, and IACBC

Jaechul Sung; Deukjo Hong; Sangjin Lee

doi:10.1007/3-540-45067-X_23

Key recovery attacks on the RMAC, TMAC, and IACBC

Jaechul Sung, Deukjo Hong, Sangjin Lee

Department of Mathematics

Korea University

Research output: Contribution to journal › Conference article › peer-review

7 Scopus citations

Abstract

The RMAC[6] is a variant of CBC-MAC, which resists birthday attacks and gives provably full security. The RMAC uses 2k-bit keys and the size of the RMAC is 2n, where n is the size of underlying block cipher. The TMAC[10] is the improved MAC scheme of XCBC[4] such that it requires (k +n)-bit keys while the XCBC requires (k +2n)-bit keys. In this paper, we introduce trivial key recovery attack on the RMAC with about 2ⁿ computations, which is more realistic than the attacks in [9]. Also we give a new attack on the TMAC using about 2 ^n/2+1 texts, which can recover an (k + n)-bit key. However this attack can not be applied to the XCBC. Furthermore we analyzed the IACBC mode[8], which gives confidentiality and message integrity.

Original language	English
Pages (from-to)	265-273
Number of pages	9
Journal	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	2727 LNCS
DOIs	https://doi.org/10.1007/3-540-45067-X_23
State	Published - 2003
Event	8th Australasian Conference on Information Security and Privacy, ACISP 2003 - Wollongong, NSW, Australia Duration: 9 Jul 2003 → 11 Jul 2003

Keywords

CBC-MAC
IACBC
Key recovery attacks
Message authentication codes
Modes of operation
RMAC
TMAC
XCBC

Access to Document

10.1007/3-540-45067-X_23

Cite this

@article{c309c765bcbb4928b3b7ed5dbfa13926,

title = "Key recovery attacks on the RMAC, TMAC, and IACBC",

abstract = "The RMAC[6] is a variant of CBC-MAC, which resists birthday attacks and gives provably full security. The RMAC uses 2k-bit keys and the size of the RMAC is 2n, where n is the size of underlying block cipher. The TMAC[10] is the improved MAC scheme of XCBC[4] such that it requires (k +n)-bit keys while the XCBC requires (k +2n)-bit keys. In this paper, we introduce trivial key recovery attack on the RMAC with about 2n computations, which is more realistic than the attacks in [9]. Also we give a new attack on the TMAC using about 2 n/2+1 texts, which can recover an (k + n)-bit key. However this attack can not be applied to the XCBC. Furthermore we analyzed the IACBC mode[8], which gives confidentiality and message integrity.",

keywords = "CBC-MAC, IACBC, Key recovery attacks, Message authentication codes, Modes of operation, RMAC, TMAC, XCBC",

author = "Jaechul Sung and Deukjo Hong and Sangjin Lee",

year = "2003",

doi = "10.1007/3-540-45067-X_23",

language = "English",

volume = "2727 LNCS",

pages = "265--273",

journal = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

issn = "0302-9743",

publisher = "Springer Verlag",

note = "8th Australasian Conference on Information Security and Privacy, ACISP 2003 ; Conference date: 09-07-2003 Through 11-07-2003",

}

TY - JOUR

T1 - Key recovery attacks on the RMAC, TMAC, and IACBC

AU - Sung, Jaechul

AU - Hong, Deukjo

AU - Lee, Sangjin

PY - 2003

Y1 - 2003

N2 - The RMAC[6] is a variant of CBC-MAC, which resists birthday attacks and gives provably full security. The RMAC uses 2k-bit keys and the size of the RMAC is 2n, where n is the size of underlying block cipher. The TMAC[10] is the improved MAC scheme of XCBC[4] such that it requires (k +n)-bit keys while the XCBC requires (k +2n)-bit keys. In this paper, we introduce trivial key recovery attack on the RMAC with about 2n computations, which is more realistic than the attacks in [9]. Also we give a new attack on the TMAC using about 2 n/2+1 texts, which can recover an (k + n)-bit key. However this attack can not be applied to the XCBC. Furthermore we analyzed the IACBC mode[8], which gives confidentiality and message integrity.

AB - The RMAC[6] is a variant of CBC-MAC, which resists birthday attacks and gives provably full security. The RMAC uses 2k-bit keys and the size of the RMAC is 2n, where n is the size of underlying block cipher. The TMAC[10] is the improved MAC scheme of XCBC[4] such that it requires (k +n)-bit keys while the XCBC requires (k +2n)-bit keys. In this paper, we introduce trivial key recovery attack on the RMAC with about 2n computations, which is more realistic than the attacks in [9]. Also we give a new attack on the TMAC using about 2 n/2+1 texts, which can recover an (k + n)-bit key. However this attack can not be applied to the XCBC. Furthermore we analyzed the IACBC mode[8], which gives confidentiality and message integrity.

KW - CBC-MAC

KW - IACBC

KW - Key recovery attacks

KW - Message authentication codes

KW - Modes of operation

KW - RMAC

KW - TMAC

KW - XCBC

UR - http://www.scopus.com/inward/record.url?scp=24944460529&partnerID=8YFLogxK

U2 - 10.1007/3-540-45067-X_23

DO - 10.1007/3-540-45067-X_23

M3 - Conference article

AN - SCOPUS:24944460529

SN - 0302-9743

VL - 2727 LNCS

SP - 265

EP - 273

JO - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

JF - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

T2 - 8th Australasian Conference on Information Security and Privacy, ACISP 2003

Y2 - 9 July 2003 through 11 July 2003

ER -

Key recovery attacks on the RMAC, TMAC, and IACBC

Abstract

Keywords

Access to Document

Other files and links

Fingerprint

Cite this