Re: [Cfrg] UMAC draft version 06

Thanks Ted for the clarifying note. I agree that not mentioning the
precise 2.01 factor in the introduction is a reasonable move.

One thing regarding your note: I wouldnt treat the delta factor as
generically insignificant. It may be insignificant, or it may be very
significant... we dont know...

Ran

On Thu, 20 Oct 2005, Ted Krovetz wrote:

> > [The introduction] omits the factor 2.01, and thus misstates the
> > conclusions of the security analysis.
>
> We have striven to make the I-D readable to a broad audience and to
> make the introduction simpler than the security considerations. In
> past drafts, this translated to saying in the introduction that UMAC
> had forgery probabilities no more than 2^-30i and saying in the
> security section that so long as AES was secure that forgery
> probabilities were no more than 2^-30i. This gets the basic message
> across (longer tags give proportionally lower forgery probability),
> and the sophisticated reader of the security section would infer the
> AES-delta-term's existence.
>
> This wasn't "honest" enough for many, so we have changed our
> presentation. Now the introduction says forgery probability is 2^-30i
> + delta where value delta "measures the security of the pseudorandom
> function." Here delta is a general term that includes anything
> related to breaking AES. Making a more explicit claim of 2^-30i +
> 3*delta would probably make things less clear for those who simply
> read introductions. The security section is now more explicit saying
> that forgery probabilities are no more than 2^-30i + 3*delta, and it
> gives a more explicit discussion of delta. [See footnote.]
>
> This more simplistic use of a delta term in the introduction along
> with a more precise usage in the security section seems reasonable
> and appropriate.
>
> Our core claim has not changed over any of these drafts: So long as
> AES is not broken, UMAC forgery probability is no more than 2^-30i.
>
> -Ted
>
> [Footnote.] The 3*delta term could be written 1.01*(delta(2^64)+delta
> (82)), where delta(q) is PRP distinguishing probability over q
> queries. This would make the 3*delta term much closer to 1*delta(q)
> than 3*delta(q), but we didn't want any ugly terms in the I-D so we
> wrote 3*delta. If delta is generally considered insignificant, so
> should 3*delta.
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@ietf.org
> https://www1.ietf.org/mailman/listinfo/cfrg
>

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg