Re: [Cfrg] VMAC Internet-Draft Available

Hi David,

> I do have a quick question, though.  What would change if the high  
> level structure were modified to something like Tag = F_K2(H_K1 
> (M))?  As you probably guessed, the reason that I ask is that I  
> believe that there are applications that would be interested in  
> alternatives to HMAC, but which would prefer to use a MAC that does  
> not require a sequence number.

Two things, really only affecting short-tag macs:

1) Speed on short messages. Because I use only half an AES output per  
VMAC-64 mac tag, VMAC can save a hundred or so cycles on average by  
caching AES outputs on sequential nonces. Your suggestion wouldn't  
allow this kind of caching.

2) Birthday bound. F_K2(H_K1(M)) gives away knowledge of hash  
collisions when they happen. If we define this as failure, then over  
q tags, failure occurs with probability around (q(q-1)/2) \epsilon  
for an \epsilon-AU hash family.

These issues are really only relevant for VMAC-64 and UMAC-32/64/96.  
For VMAC/UMAC-128, \epsilon is low enough to tolerate the birthday  
bound and AES caching is not possible. So, my next project is to look  
at constructing a universal-hash-based incarnation of Phil's SIV mode  
(which is essentially F_K2(H_K1(M)) on steroids).

Something should come out this summer.

-Ted

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg