New Generic Attacks on Hash-based MACs G. Leurent (Inria) New - PowerPoint PPT Presentation

Introduction New generic attacks HMAC-GOST key-recovery Conclusion New Generic Attacks on Hash-based MACs G. Leurent (Inria) New Generic Attacks on Hash-based MACs Asiacrypt 2013 1 / 22 . . . . . . . . . . . . . . . . . Gaëtan Leurent, Thomas Peyrin, Lei Wang Inria, France  UCL, Belgium Nanyang Technological University, Singapore Asiacrypt 2013

2 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion Message Authentication Codes G. Leurent (Inria) ? . . . . . . . . . . . . . . . . . . . . . . . . M , t Alice Bob ▶ Alice sends a message to Bob ▶ Bob wants to authenticate the message. ▶ Alice use a key k to compute a tag: t = MAC k ( M ) ▶ Bob verifies the tag with the same key k : t = MAC k ( M ) ▶ Symmetric equivalent to digital signatures

3 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion MAC Constructions G. Leurent (Inria) . . . . . . . . . . . . . . . . . ▶ Dedicated designs ▶ PelicanMAC, SQUASH, SipHash ▶ From universal hash functions ▶ UMAC, VMAC, Poly1305 ▶ From block ciphers ▶ CBCMAC, OMAC, PMAC ▶ From hash functions ▶ HMAC, SandwichMAC, EnvelopeMAC

3 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion MAC Constructions G. Leurent (Inria) . . . . . . . . . . . . . . . . . ▶ Dedicated designs ▶ PelicanMAC, SQUASH, SipHash ▶ From universal hash functions ▶ UMAC, VMAC, Poly1305 ▶ From block ciphers ▶ CBCMAC, OMAC, PMAC ▶ From hash functions ▶ HMAC, SandwichMAC, EnvelopeMAC

4 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion HMAC G. Leurent (Inria) . . . . . . . . . . . . . . . . . ▶ HMAC has been designed by Bellare, Canetti, and Krawczyk in 1996 ▶ Standardized by ANSI, IETF, ISO, NIST. ▶ Used in many applications: ▶ To provide authentication: ▶ SSL, IPSEC, ... ▶ To provide identification: ▶ Challengeresponse protocols ▶ CRAMMD5 authentication in SASL, POP3, IMAP, SMTP, ... ▶ For keyderivation: ▶ HMAC as a PRF in IPsec ▶ HMACbased PRF in TLS

5 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion Hash-based MACs G. Leurent (Inria) . . . . . . . . . . . . . . . . . m 0 m 1 m 2 | M | h h h g k l l l l n I k MAC k ( M ) x 0 . . . . . . . . . . . . . . . . . . . . x 1 x 2 x 3 ▶ l bit chaining value ▶ n bit output ▶ k bit key ▶ Keydependant initial value I k ▶ Unkeyed compression function h ▶ Keydependant finalization, with message length g k

6 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion Security of HMAC G. Leurent (Inria) . . . . . . . . . . . . . . . . . Security proof / Attack ▶ Existential forgery: 2 l / 2 2 l / 2 ▶ Forge a valid pair ▶ Universal forgery: 2 l / 2 2 n ▶ Predict the MAC of a challenge ▶ DistinguishingR: 2 l / 2 2 l / 2 ▶ Distinguish HMAC from a PRF ▶ DistinguishingH: 2 l / 2 2 l ▶ Distinguish HMACSHA1 from HMACPRF ▶ Staterecovery: 2 l / 2 2 l ▶ Find the internal state after some message ▶ Keyrecovery: 2 l / 2 2 k ▶ Extract the key from a MAC oracle

7 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion Distinguishing-H attack G. Leurent (Inria) . . . . . . . . . . . . . . . . . k ← $ M . . . . . . . . . MAC k ( M ) OXYGEN Adversary Oracle H k or HMAC PRF HMAC H k ▶ Security notion from PRF ▶ Distinguish HMAC using H from HMAC with a PRF

8 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion Distinguishing-H attack G. Leurent (Inria) . . . . . . . . . . . . . . . . . ▶ Collisionbased attack does not work: ▶ Any compression function has collisions ▶ Secret key prevents precomputed collisions ▶ Folklore assumption: distinguishingH attack should require 2 l “ If we can recognize the hash function inside HMAC, it must be a bad hash function ”

9 / 22 Introduction Asiacrypt 2013 New Generic Attacks on Hash-based MACs G. Leurent (Inria) Key-recovery Attack on HMAC-GOST Introduction New generic attacks Outline Conclusion HMAC-GOST key-recovery New generic attacks . . . . . . . . . . . . . . . . . MACs HMAC Cycle detection DistinguishingH attack State recovery attack HMACGOST Key recovery

10 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion Main Idea G. Leurent (Inria) . . . . . . . . . . . . . . . . . | M | 0 0 0 h h h g K l l l l n I K MAC K ( M ) x 0 . . . . . . . . . . . . . . . . . . . . x 1 x 2 x 3 ▶ Using a fixed message block, we iterate a fixed function ▶ Starting point and ending point unknown because of the key Can we detect properties of the function h 0 ∶ x ↦ h ( x , 0 ) ? ▶ Study the cycle structure of random mappings ▶ Used to attack HMAC in relatedkey setting [Peyrin, Sasaki  Wang, Asiacrypt 12]

10 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion Main Idea G. Leurent (Inria) . . . . . . . . . . . . . . . . . | M | 0 0 0 h h h g K l l l l n I K MAC K ( M ) x 0 . . . . . . . . . . . . . . . . . . . . x 1 x 2 x 3 ▶ Using a fixed message block, we iterate a fixed function ▶ Starting point and ending point unknown because of the key Can we detect properties of the function h 0 ∶ x ↦ h ( x , 0 ) ? ▶ Study the cycle structure of random mappings ▶ Used to attack HMAC in relatedkey setting [Peyrin, Sasaki  Wang, Asiacrypt 12]

11 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion Random Mappings G. Leurent (Inria) . . . . . . . . . . . . . . . . . x 3 ▶ Functional graph of a random mapping x 4 x → f ( x ) ▶ Iterate f : x i = f ( x i − 1 ) x 2 x 7 x 5 ▶ Collision after ≈ 2 l / 2 iterations x 6 ▶ Cycles x 1 ▶ Trees rooted in the cycle ▶ Several components . . . . . . . . . x 0

11 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion Random Mappings G. Leurent (Inria) . . . . . . . . . . . . . . . . . ▶ Functional graph of a random mapping x → f ( x ) ▶ Iterate f : x i = f ( x i − 1 ) ▶ Collision after ≈ 2 l / 2 iterations ▶ Cycles ▶ Trees rooted in the cycle ▶ Several components . .

11 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion Random Mappings G. Leurent (Inria) . . . . . . . . . . . . . . . . . ▶ Functional graph of a random mapping x → f ( x ) ▶ Iterate f : x i = f ( x i − 1 ) ▶ Collision after ≈ 2 l / 2 iterations ▶ Cycles ▶ Trees rooted in the cycle ▶ Several components . .

12 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion Cycle structure G. Leurent (Inria) . . . . . . . . . . . . . . . . . Expected properties of a random mapping over N points: ▶ # Components: 1 2 log N ▶ # Cyclic nodes: √𝜌 N / 2 ▶ Tail length: √𝜌 N / 8 ▶ Rho length: √𝜌 N / 2 ▶ Largest tree: 0 . 48 N ▶ Largest component: 0 . 76 N

13 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion Using the cycle length G. Leurent (Inria) Success if . . . . . . . . . . . . . . . . . 1 Offline: find the cycle length L of the main component of h 0 . . . 2 Online: query t = MAC ( r ‖ [ 0 ] 2 l / 2 ) and t ′ = MAC ( r ‖ [ 0 ] 2 l / 2 + L ) ▶ The starting point is in the main component p = 0 . 76 ▶ The cycle is reached with less than 2 l / 2 iterations p ≥ 0 . 5 Randomize starting point

13 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion Cycle structure G. Leurent (Inria) . . . . . . . . . . . . . . . . . Expected properties of a random mapping over N points: ▶ # Components: 1 2 log N ▶ # Cyclic nodes: √𝜌 N / 2 ▶ Tail length: √𝜌 N / 8 ▶ Rho length: √𝜌 N / 2 ▶ Largest tree: 0 . 48 N ▶ Largest component: 0 . 76 N

13 / 22 Introduction Asiacrypt 2013 New generic attacks New Generic Attacks on Hash-based MACs HMAC-GOST key-recovery Conclusion Using the cycle length G. Leurent (Inria) Success if . . . . . . . . . . . . . . . . . 1 Offline: find the cycle length L of the main component of h 0 . . . 2 Online: query t = MAC ( r ‖ [ 0 ] 2 l / 2 ) and t ′ = MAC ( r ‖ [ 0 ] 2 l / 2 + L ) ▶ The starting point is in the main component p = 0 . 76 ▶ The cycle is reached with less than 2 l / 2 iterations p ≥ 0 . 5 Randomize starting point