UMAC: Fast and Secure Message Authentication

Abstract

We describe a message authentication algorithm, UMAC, which can authenticate messages (in software, on contemporary machines) roughly an order of magnitude faster than current practice (e.g., HMAC-SHA1), and about twice as fast as times previously reported for the universal hash-function family MMH. To achieve such speeds, UMAC uses a new universal hash-function family, NH, and a design which allows effective exploitation of SIMD parallelism. The "cryptographic" work of UMAC is done using standard primitives of the user's choice, such as a block cipher or cryptographic hash function; no new heuristic primitives are developed here. Instead, the security of UMAC is rigorously proven, in the sense of giving exact and quantitatively strong results which demonstrate an inability to forge UMAC-authenticated messages assuming an inability to break the underlying cryptographic primitive. Unlike conventional, inherently serial MACs, UMAC is parallelizable, and will have ever-faster implementation speeds as machines offer up increasing amounts of parallelism. We envision UMAC as a practical algorithm for next-generation message authentication.Michael Wiener (Ed.): CRYPTO'99

A Modular Framework for Building Variable-Input-Length Tweakable Ciphers

“…Putting together Theorems 1,2, and results from previous works [10,24], we have the following security bound.…”

“…Fortunately, a result by Coron, et al [15] shows that one can compress tweaks using an -AU hash function at the cost of adding a q 2 term to the tweakable cipher's TPRP security bound. In particular, we will use (a slight specialization of) the NH hash, defined by Black, et al [10]; NH[r, s] L takes r-bit keys (|L| = r), maps r-bit strings to s-bit strings, and is 2 s/2 -AU. Please see Table 10 for the description.…”

“…These limitations are a consequence of using the NH hash function; however, a simple extension to NH (described by the original authors [10]) accommodates arbitrarily long strings. Fix a positive integer r and define NH * 2N ].…”

“…Ti ⊗ L i , NH(νw, 2tw) [10]: -AU hash function with = 1/2 tw . Inputs are νw bits, where ν is even and w > 0 is fixed.…”

On the Internal Structure of Alpha-MAC

“…MAC functions take a secret key and a message as input and generate a short digest as output. Many research groups have presented various approaches to construct MAC functions, for example, MAA [13], CBC-MAC [15], UMAC [9], MDx-MAC [16] and HMAC [4,5].…”