universal MACs [was: Re: [Cfrg] Re: [saag] Bad day at the hash function factory]

["David A. McGrew" <mcgrew at cisco.com>]

Dan,

On Sep 26, 2004, at 12:50 PM, D. J. Bernstein wrote:

> A note to everyone using HMAC: Modern polynomial-evaluation MACs (such
> as GCM MAC) offer strong security guarantees (they're provably as 
> secure
> as AES) and are faster than HMAC-SHA1.

yes, thanks for pointing this out.  It would be worth having a 
discussion on universal hash based message authentication on the CFRG 
list.  (We should probably start a new thread for it too, so I've done 
that.)  I know that several others in CFRG are interested in this sort 
of work.  They'd probably also be interested in your recent 
announcement on `Stronger security bounds for Wegman-Carter-Shoup 
authenticators'', http://cr.yp.to/papers.html#securitywcs.


> Some of them (not GCM MAC) are
> even faster than HMAC-MD5.

Do you mean "in software" here?  As you know, the design target for GCM 
was high-speed authenticated encryption.  Unlike much of the work that 
uses universal hashing, GCM aims to be implementable in hardware as 
well as software.

Some other hashes, like UMAC and hash127, are better in software.  It 
would be great if CFRG could produce a specification for one or more of 
these functions.  It should not be hard to get some others to verify 
the test vectors.    I suspect that the group preference would be 
towards hash functions that are portable (e.g. fast on a wide variety 
of CPUs) and that require minimal per-key state.  There may be other 
points of view; others please chime in if you have other priorities.

David

> ---D. J. Bernstein, Associate Professor, Department of Mathematics,
> Statistics, and Computer Science, University of Illinois at Chicago
> _______________________________________________
> saag mailing list
> saag at mit.edu
> https://jis.mit.edu/mailman/listinfo/saag


_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg