<inline-formula><tex-math id="M1">\begin{document}$\textsf{DWCDM+}$\end{document}</tex-math></inline-formula>: A BBB secure nonce based MAC

Abstract

In CRYPTO 2016, Cogliati and Seurin have proposed a nonce-based MAC called Encrypted Wegman-Carter with Davies-Meyer ($\textsf{EWCDM}$), from an $n$-bit block cipher $\textsf{E}$ and an $n$-bit almost xor universal hash function$\textsf{H}$ as \begin{document}$\textsf{E}_{K_2}\bigl(\textsf{E}_{K_1}(N)\oplus N\oplus \textsf{H}_{K_h}(M)\bigr),$ \end{document} for a nonce $N$ and a message $M$ that provides roughly $2n/3$-bit MAC security. However, obtaining the similar security using a single block cipher key was posed as an open research problem. In this paper, we present Decrypted Wegman-Carter with Davies-Meyer ($\textsf{DWCDM+}$) construction based on a single block cipher key that provides $2n/3$-bit MAC security from an $n$-bit block cipher $\textsf{E}$ and an $n$-bit $k$-regular ($\forall k \leq n$), almost xor universal hash function $\textsf{H}$ as \begin{document} $ \textsf{E}^{-1}_{K}\bigl(\textsf{E}_{K}(N)\oplus N \oplus \textsf{H}_{K_h}(M)\bigr). $ \end{document} $\textsf{DWCDM+}$ is structurally very similar to its predecessor $\textsf{EWCDM}$ except that the facts that (i) the number of block cipher keys reduced from $2$ to $1$ and (ⅱ) the outer encryption call is replaced by a decryption one. To make the construction truely single-keyed, here we derive the hash key $K_h$ as the block cipher output of a fixed string $0^{n-2} \| 10$ as long as the hash key is of $n$ bits. We show that if the nonce space is restricted to $(n-1)$ bits, $\textsf{DWCDM+}$ is secured roughly up to $2^{2n/3}$ MAC queries ($2^{n/2}$ MAC queries) and $2^n$ verification queries against nonce respecting (nonce misuse resp.) adversaries.