Multi-property-preserving domain extension using polynomial-based modes of operation

• Authors: Jooyoung Lee;John Steinberger
• Venue: EUROCRYPT'10 Proceedings of the 29th Annual international conference on Theory and Applications of Cryptographic Techniques
• Year: 2010

In this paper, we propose a new double-piped mode of operation for multi-property-preserving domain extension of MACs (message authentication codes), PRFs (pseudorandom functions) and PROs (pseudorandom oracles). Our mode of operation performs twice as fast as the original double-piped mode of operation of Lucks [15] while providing comparable security. Our construction, which uses a class of polynomial-based compression functions proposed by Stam [22,23], makes a single call to a 3n-bit to n-bit primitive at each iteration and uses a finalization function f2 at the last iteration, producing an n-bit hash function H[f1,f2] satisfying the following properties. H[f1,f2] is unforgeable up to O(2n/n) query complexity as long as f1 and f2 are unforgeable. H[f1,f2] is pseudorandom up to O(2n/n) query complexity as long as f1 is unforgeable and f2 is pseudorandom. H[f1,f2] is indifferentiable from a random oracle up to O(22n/3) query complexity as long as f1 and f2 are public random functions. To our knowledge, our result constitutes the first time O(2n/n) unforgeability has been achieved using only an unforgeable primitive of n-bit output length. (Yasuda showed unforgeability of O(25n/6) for Lucks’ construction assuming an unforgeable primitive, but the analysis is sub-optimal; in the appendix, we show how Yasuda’s bound can be improved to O(2n).) In related work, we strengthen Stam’s collision resistance analysis of polynomial-based compression functions (showing that unforgeability of the primitive suffices) and discuss how to implement our mode by replacing f1 with a 2n-bit key blockcipher in Davies-Meyer mode or by replacing f1 with the cascade of two 2n-bit to n-bit compression functions.