Earticle

초록

영어

This paper presents the first equivalent key recovery attack on H2-MAC-MD5, which
conduces to a selective forgery attack directly. H2-MAC is similar with HMAC except that
the outer key is omitted. For HMAC-MD5, since the available differential paths are pseudo-
collisions, all the key recovery attacks are in the related-key setting, while our attack on H2-
MAC-MD5 gets rid of this restriction. Based on the distinguisher of HMAC-MD5 proposed
by Wang et al., a pair of intermediate chaining variables, i.e., the equivalent keys ( ˜K , ˜K ′),
is detected which fulfils the specific conditions on (IV, IV ′) of the pseudo-collision. Then
the inner key recovery attack on HMAC-MD5 explored by Contini and Yin is adopted to
recover ( ˜K , ˜K ′). Consequently, the adversary can compute the valid MAC value of M0kM∗
effortlessly, where M0 is a fixed one-block message, and M∗ can be any bit string.
Keywords: Cryptanalysis, H2-MAC-MD5, Distinguishing attack, Equivalent key recovery
attack

목차

Abstract
 1 Introduction
 2 Preliminaries
  2.1 Notations
  2.2 Brief Description of MD5
  2.3 Pseudo-collisions of MD5
  2.4 Brief Description of H2-MAC
 3 Equivalent Key Recovery Attack on H2-MAC-MD5
  3.1 Distinguishing Attack on H2-MAC-MD5
  3.2 Recovering the Equivalent Key ˜K
  3.3 Selective Forgery Attack
 4 Conclusions
 References

저자

• Wei Wang [ School of Computer Science and Technology, Shandong University, Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University ]

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  International Journal of Security and Its Applications

• 간기

  격월간

• pISSN

  1738-9976

• 수록기간

  2008~2016

• 등재여부

  SCOPUS

• 십진분류

  KDC 505 DDC 605