Updates on generic attacks against HMAC and NMAC

Abstract

In this paper, we present new generic attacks against HMAC and other similar MACs when instantiated with an n-bit output hash function maintaining a l-bit internal state. Firstly, we describe two types of selective forgery attacks (a forgery for which the adversary commits on the forged message beforehand). The first type is a tight attack which requires O(2l/2) computations, while the second one requires O(22l/3) computations, but offers much more freedom degrees in the choice of the committed message. Secondly, we propose an improved universal forgery attack which significantly reduces the complexity of the best known attack from O(25l/6) to O(23l/4). Finally, we describe the very first time-memory tradeoff for key recovery attack on HMAC. With O(2l) precomputation, the internal key Kout is firstly recovered with O(22l/3) computations by exploiting the Hellman's time-memory tradeoff, and then the other internal key Kin is recovered with O(23l/4) computations by a novel approach. This tends to indicate an inefficiency in using long keys for HMAC. © 2014 International Association for Cryptologic Research.