Proceedings of the 14th ACM conference on Computer and communications security
Aggregate and verifiably encrypted signatures from bilinear maps
EUROCRYPT'03 Proceedings of the 22nd international conference on Theory and applications of cryptographic techniques
Efficient sequential aggregate signed data
EUROCRYPT'08 Proceedings of the theory and applications of cryptographic techniques 27th annual international conference on Advances in cryptology
Aggregate message authentication codes
CT-RSA'08 Proceedings of the 2008 The Cryptopgraphers' Track at the RSA conference on Topics in cryptology
New proofs for NMAC and HMAC: security without collision-resistance
CRYPTO'06 Proceedings of the 26th annual international conference on Advances in Cryptology
How to aggregate the CL signature scheme
ESORICS'11 Proceedings of the 16th European conference on Research in computer security
SAC'11 Proceedings of the 18th international conference on Selected Areas in Cryptography
MAC aggregation protocols resilient to DoS attacks
International Journal of Security and Networks
History-Free sequential aggregate signatures
SCN'12 Proceedings of the 8th international conference on Security and Cryptography for Networks
MAC aggregation with message multiplicity
SCN'12 Proceedings of the 8th international conference on Security and Cryptography for Networks
A privacy-preserving path-checking solution for RFID-Based supply chains
ICICS'12 Proceedings of the 14th international conference on Information and Communications Security
Sequential aggregate signatures with lazy verification from trapdoor permutations
ASIACRYPT'12 Proceedings of the 18th international conference on The Theory and Application of Cryptology and Information Security
Hi-index | 0.00 |
Aggregate message authentication codes, as introduced by Katz and Lindell (CT-RSA 2008), combine several MACs into a single value, which has roughly the same size as an ordinary MAC. These schemes reduce the communication overhead significantly and are therefore a promising approach to achieve authenticated communication in mobile ad-hoc networks, where communication is prohibitively expensive. Here we revisit the unforgeability notion for aggregate MACs and discuss that the definition does not prevent "mix-and-match" attacks in which the adversary turns several aggregates into a "fresh" combination, i.e., into a valid aggregate on a sequence of messages which the attacker has not requested before. In particular, we show concrete attacks on the previous scheme. To capture the broader class of combination attacks, we provide a stronger security notion of aggregation unforgeability. While we can provide stateful transformations lifting (non-ordered) schemes to meet our stronger security notion, for the statefree case we switch to the new notion of history-free sequential aggregation. This notion is somewhat between non-ordered and sequential schemes and basically says that the aggregation algorithm is carried out in a sequential order but must not depend on the preceding messages in the sequence, but only on the shorter input aggregate and the local message. We finally show that we can build an aggregation-unforgeable, history-free sequential MAC scheme based on general assumptions.