The sum of CBC MACs is a secure PRF

Abstract

We present a new message authentication code (MAC) based on block ciphers. Our new MAC algorithm, though twice as slow as an ordinary CBC MAC, can be proven to be a pseudo-random function secure against O(22n/3) queries, under the assumption that the underlying n-bit block cipher is a secure pseudo-random permutation. Our design is quite simple, being similar to Algorithm 5 (and 6) of ISO/IEC 9797-1:1999-we just take the sum (xor) of two encrypted CBC MACs. We remark that no proof of security above the birthday bound (2n/2) has been known for the sum of CBC MACs. The sum construction now becomes the first realization of a block-cipher-based, deterministic, stateless MAC algorithm being provably secure beyond the birthday bound of O(2n/2) and running with practical efficiency. © 2010 Springer-Verlag.