Re: [Cfrg] New UMAC Draft

Ted Krovetz writes:
> On September 9, Russ Housley asked if there were any  
> ``cryptographic concerns'' with UMAC.

I find myself extremely skeptical of your claimed bounds on the
attacker's single-forgery probability against UMAC: 2^(-30), 2^(-60),
2^(-90), and 2^(-120). Would you be surprised if I told you that I have
an attack achieving a larger forgery probability? How about much larger?

It is thoroughly irresponsible of you to claim ``rigorously proven''
bounds that you have not, in fact, proven. This is not merely a question
of dotting the i's and crossing the t's; there is a very important piece
of the proof that you obviously haven't even tried to do.

It is not _my_ responsibility to demonstrate that your bounds are wrong.
It is _your_ responsibility to avoid making unjustified claims. Suppose
that a user chooses UMAC-128 on the basis of your ``rigorously proven''
2^(-120) bound on the probability of a forgery succeeding, and then that
bound turns out to be incorrect; wouldn't you be ashamed for having
misled the user?

I am _not_ saying that UMAC is easily breakable. UMAC is close to
Gilbert-MacWilliams-Sloane, and I'm willing to believe that the changes
don't destroy security. However, I find myself extremely skeptical of
your specific quantitative claims of forgery-probability bounds.

> Clearly you believe that an \e-SU hash family wed with AES makes a  
> good MAC (witness Poly1305-AES).

The Poly1305-AES paper gives a precise statement and proof of the
Poly1305-AES security bound.

If you're going to claim a security bound then you need to show us a
proof. Your UMAC security claim is as follows, for each n in {1,2,3,4}:

   Claimed theorem. An attack against UMAC-32n using at most 2^64 chosen
   messages and one forgery attempt cannot have success probability
   larger than 2^{-30n}, if AES is secure.

Please define ``secure'' and then show us the proof of this claimed
forgery-probability bound.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg