Distinguishing attacks on LPMAC based on the full RIPEMD and reduced-step RIPEMD-{256, 320}

  • Authors:

  • Gaoli Wang

  • Affiliations:

  • School of Computer Science and Technology, Donghua University, Shanghai, China and State Key Laboratory of Information Security Institute of Software, Chinese Academy of Sciences, Beijing, China

  • Venue:
  • Inscrypt'10 Proceedings of the 6th international conference on Information security and cryptology
  • Year:
  • 2010

Quantified Score

Hi-index 0.01

Visualization

Abstract

This paper presents the first distinguishing attack on the LPMAC based on RIPEMD, 58-step reduced RIPEMD-256 and 48-step reduced RIPEMD-320, and the LPMAC is the secret-prefix MAC with the message length prepended to the message before hashing. Wang et al. presented the first distinguishing attack on HMAC/NMAC-MD5 without the related-key setting in [27], then they extended this technique to give a distinguishing attack on the LPMAC based on 61-step SHA-1 in [24]. In this paper, we utilize the techniques in [24, 27] combined with our pseudo-near-collision differential path on the full RIPEMD, 58-step reduced RIPEMD-256 and 48-step reduced RIPEMD-320 to distinguish the LPMAC based on the full RIPEMD, 58-step reduced RIPEMD-256 and 48-step reduced RIPEMD-320 from the LPMAC based on a random function respectively. Because RIPEMD and RIPEMD-{256, 320} all contain two different and independent parallel lines of operations, the difficulty of our attack is to choose proper message differences and to find proper near-collision differential paths of the two parallel lines of operations. The complexity of distinguishing the LPMAC based on the full RIPEMD is about 266 MAC queries. For the LPMAC based on 58-step reduced RIPEMD-256 and 48-step reduced RIPEMD-320, the complexities are about 2163.5 MAC queries and 2208.5 MAC queries respectively.