Re: [Cfrg] New UMAC Draft

Ted Krovetz writes:
> Please tell me which of the following is not true:
  [ series of lemmas that might be useful in a UMAC security proof ]

As I see it, the main risk of error is not in any of your lemmas, but
in how you're putting the lemmas together to obtain an overall bound on
the UMAC forgery probability. Certainly this is the part that led to
your incorrect UMAC security claims last year, and the part where you're
continuing to be incredibly sloppy.

Your latest UMAC security claim (which, like your incorrect claims, is
alleged to be ``rigorously proven'') appears to be the following:

   Claimed theorem. An attack against UMAC-32n using at most 2^64 chosen
   messages and one forgery attempt cannot have success probability
   larger than 2^{-30n}, if AES is secure.

There isn't much wiggle room here: you haven't defined ``secure'' yet,
but you've clearly stated that you're bounding the forgery probability,
you've clearly stated that your bounds are exactly 2^{-30}, 2^{-60},
2^{-90}, 2^{-120} for UMAC-32, UMAC-64, UMAC-96, and UMAC-128, and
you've clearly stated that you're allowing 2^64 chosen messages.

Please define ``secure'' and then show us the proof of this claimed
forgery-probability bound.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg