基于缩减到53(20-72)步的SHA-1的H2-MAC的等价密钥恢复攻击

H2-MAC是Kan Yasuda在ISC 2009上提出的一种新型的MAC结构,与HMAC的不同之处仅在于H-MAC用固定的常数IV代替HMAC的外部密钥,计算MAC值时只访问一次种子密钥,在保持HMAC优势的基础上简化密钥管理。文中首次给出基于缩减到53 (20-72)步的SHA-1的H2-MAC的等价密钥恢复攻击,并进行一般性伪造攻击的理想复杂度。

Equivalent Key Recovery Attack on H-MAC Instantiated with SHA-1 Reduced to 53 (20-72) Steps

H2-MAC, which was proposed by Kan Yasuda in Information Security Conference (ISC) 2009, is a new type of MAC construction. Compared with HMAC,H2-MAC is much easier for algorithm implementation and key management, for it gets access to the key only once. This paper first presents an equivalent key recovery attack H2-MAC-SHA-1 reduced to 53 (20-72) steps, which conduces to a universal forgery attack directly. Firstly, an H2-MAC-SHA-1 distinguisher is constructed. Then, the intermediate chaining variable, i.e., the equivalent key is recovered by using the distinguisher and bit flipping technology. Consequently, the universal forgery attack is processed. The adversary unknowing the secret key can process the universal forgery attack by computing the valid MAC value of M, which can be an arbitrary message. The complexity of the attack is about 299 queries, which is much lower than the ideal complexity of the universal forgery.