论文部分内容阅读
H2-MAC由Kan Yasuda在ISC 2009上提出，与HMAC的不同之处在于H2-MAC没有外部密钥，简化密钥管理。首次给出 H2-MAC-MD5的等价密钥恢复攻击，并进行选择性伪造。基于HMAC-MD5区分器和比特探测技术，筛选可能满足特殊伪碰撞路线的中间链接变量，即等价密钥，并恢复其数值，导致选择性伪造。即在不知道密钥的前提下，敌手可伪造消息M0||M*的合法MAC值，其中，M0为固定的512比特消息分组，M*为任意消息。攻击的复杂度为297次MAC查询，远低于选择性伪造攻击的理想复杂度。“,”H2-MAC was proposed by Kan Yasuda in Information Security Conference (ISC) 2009, which is similar with HMAC except that the outer key is omitted, and gets rid of the disadvantage of the key management. This paper presents the first equivalent key recovery attack on H2-MAC-MD5, which conduces to a selective forgery attack directly, while there only is a distinguishing attack for HMAC-MD5. Based on the distinguisher of HMAC-MD5, a pair of intermediate chaining variables, i.e., the equivalent keys, is detected which fulfils the specific conditions on the initial variables of the pseudo-collision. Then the inner key recovery attack on HMAC-MD5 is adopted to recover the equivalent key. Consequently, the adversary can process the selective forgery attack by computing the valid MAC value of M0||M*effortlessly, where M0 is a fixed one-block message, and M*can be any bit strings. The complexity of the attack is about 297 queries, which is much lower than the ideal complexity of the selective forgery.