Re: [Cfrg] UMAC draft version 06

Hugo Krawczyk writes:
> There were NO no new security claims nor new proofs since Ted's thesis
> which has been in the public domain since 2000

False. Consider, for example, the following security claim appearing in
draft-krovetz-umac-05.txt, shortly after the claim that UMAC ``has been
rigorously proven to be secure'':

   When UMAC produces 32-, 64-, 96- or 128-bit tags, the probability
   that an attacker can produce a correct tag for any message of its
   choosing is no more than 1/2^30, 1/2^60, 1/2^90 or 1/2^120,
   respectively.

This is just one of many UMAC security claims that did not appear in the
2000 Krovetz thesis. In fact, if you look at the Krovetz thesis, you
won't find _any_ proofs of bounds on UMAC forgery probabilities! As
David Wagner put it: ``There are some claims and proofs about the UMAC
2-universal hash, but that's just a component in the UMAC authentication
scheme.''

Let me also emphasize that the above security claim is false. I've
already given a detailed explanation of a fast attack that indisputably
has much larger success probability against UMAC-128. This is an
illustration of the importance of reviewing security claims.

> The only adjustment we did recently is to move our PRF-based
> quantification to PRP-based using your recent results.

No, that's not the only ``adjustment'' you did recently. You've removed
quite a few false and questionable security claims---while failing to
state for the record that you are no longer making those claims---and
replaced them with different security claims. The new claims need
review, just as the old ones did.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg