Subject: [Cfrg] Critical gap in the UMAC security ``proof''

From: David Wagner <[email-masked]>
Date: Sat, 22 Oct 2005 00:34:52 -0700 (PDT)

Hal Finney writes:
>The idea is that for 4- or 8-byte tags, the 16-byte AES-encrypted
>nonce value gets divided into respectively 4 or 2 parts, allowing one
>AES encryption to serve for 4 or 2 tags (assuming sequential nonces).
>It is a performance optimization. If you look down a little farther
>you will see that it shifts which subset of the AES output is used,
>depending on the low order 1 or 2 bits of the nonce.

Oh, of course.  Thanks for the explanation! 

Well, the rest of David McGrew's analysis looked convincing to me: I
can't see any way that AES inputs would collide (except with negligible
probability).  But I could always have missed something...

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg