CCTR认证模式的不可证明安全性

Unprovable Security of CCTR Authentication Mode

消息认证码是现代密码学中用以检验数据完整性和数据起源认证的重要手段.分组密码认证模式是利用分组密码为基础部件来实现认证功能的一种工作模式.安全和效率是消息认证码的设计过程中需要权衡的两个方面.为了提高分组密码认证模式的效率,2009年,黄玉划等人提出了一种基于链接与计数的快速认证模式(CCTR),并从统计评估的角度验证了CCTR模式的安全性.本文利用底层分组密码的特性,分别从实际攻击的角度和可证明安全性的角度对CCTR模式的安全性进行了分析.利用CCTR模式中部分分组密码密钥输入部分可控的特点,我们进行选择消息攻击.两种攻击方法只需对标签生成算法询问一次,就可以伪造成功.研究结果表明:在CCTR模式实际使用中,当所用分组密码具有一个和DES相同的性质时,CCTR模式是不安全的;当所用分组密码是一个有弱密钥的伪随机置换时,CCTR模式也是不安全的.同时表明,原文中CCTR模式的安全性证明是错误的,仅仅在伪随机置换的假设下,不足以证明CCTR模式安全性.

Message Authentication Code(MAC) is an important means to verify data integrity and data origin in modern cryptography. Block cipher authentication mode is a MAC based on block cipher. We do trade-off between security and efficiency in designing MAC. In order to improve the efficiency, Huang et al. proposed a MAC using chaining and counter(CCTR) mode and tested its security through statistical evaluation. In this paper, we analyze the security of CCTR by a practical attack and give a counter example against its provable security. We adopt the chosen-message attack by controlling the input of key to some underlying block ciphers. The two successful forgery attacks only need to query the tag-generating algorithm once. We show that CCTR is not secure when using a DES-like block cipher or a block cipher with some weak keys. We also show that the result of provable security about CCTR is wrong since it is insufficient to prove its security under the assumption of pseudorandom permutation(PRP).