Re: [Cfrg] UMAC draft version 06

> [The introduction] omits the factor 2.01, and thus misstates the  
> conclusions of the security analysis.

We have striven to make the I-D readable to a broad audience and to  
make the introduction simpler than the security considerations. In  
past drafts, this translated to saying in the introduction that UMAC  
had forgery probabilities no more than 2^-30i and saying in the  
security section that so long as AES was secure that forgery  
probabilities were no more than 2^-30i. This gets the basic message  
across (longer tags give proportionally lower forgery probability),  
and the sophisticated reader of the security section would infer the  
AES-delta-term's existence.

This wasn't "honest" enough for many, so we have changed our  
presentation. Now the introduction says forgery probability is 2^-30i  
+ delta where value delta "measures the security of the pseudorandom  
function." Here delta is a general term that includes anything  
related to breaking AES. Making a more explicit claim of 2^-30i +  
3*delta would probably make things less clear for those who simply  
read introductions. The security section is now more explicit saying  
that forgery probabilities are no more than 2^-30i + 3*delta, and it  
gives a more explicit discussion of delta. [See footnote.]

This more simplistic use of a delta term in the introduction along  
with a more precise usage in the security section seems reasonable  
and appropriate.

Our core claim has not changed over any of these drafts: So long as  
AES is not broken, UMAC forgery probability is no more than 2^-30i.

-Ted

[Footnote.] The 3*delta term could be written 1.01*(delta(2^64)+delta 
(82)), where delta(q) is PRP distinguishing probability over q  
queries. This would make the 3*delta term much closer to 1*delta(q)  
than 3*delta(q), but we didn't want any ugly terms in the I-D so we  
wrote 3*delta. If delta is generally considered insignificant, so  
should 3*delta.

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg