Attack Exploiting Property (ii) Sample Clauses

Attack Exploiting Property (ii). Assume that I = 0128. Using Lemma 1 property (ii), we can perform the following distinguishing attack. – Let N, A, τ be any nonce, associated data, and tag size; – Let 0 A < 128. Let Mv, Mvj 0, 1 A be any two distinct message blocks. Write Mu = Mv10∗ and Muj = Mvj10∗. Let Mxy 0, 1 256−τ be any message block. Write M = MuǁMvǁMxy and M = Muj ǁMvjǁMxy; – Query C = O(N, A, τ, M ) ∈ {0, 1}|M|+τ and Cj = O(N, A, τ, Mj) ∈ {0, 1}|Mr|+τ . Write C = CuǁCvǁCxǁCy and Cj = Cuj ǁCvj ǁCxj ǁCyj , where – If |Cu| = |Cx| = |Cy| = |Cuj | = |Cxj | = |Cyj | = 128, and |Cv| = |Cvj | = A; Mu ⊕ Cu ⊕ Muj ⊕ Cuj = 0128, (4) output 0, otherwise output 1. The verification of the attack is a bit more complex than for case (i), and relies on the key observation that in the real world, S = Sj. In more detail, if = K, we have u X = X ⊕ X v u = E˜0,4 (M ) ⊕ E˜0,5 u (M 10∗) (=ii) 0128, and v 0128 ǁJǁL u 0128 ǁJǁL v 0128 ǁJǁL 0128 ǁJǁL Xj = Xj ⊕ Xj = E˜0,4 (Mj ) ⊕ E˜0,5 (Mj10∗) = 0128. In other words, X = Xj. Furthermore, as (τ, N, A) is the same in both evalua- tions, Δ = AEZ-hash(0128ǁJǁL, τ, N, A) = Δj. Finally, the two different queries satisfy Mxy = Mxjy. From Algorithm 2 we obtain that the intermediate value S is a function of Mxy,X, and Δ, and thus, S = Sj. ˜= E −1,4 We consequently obtain u M ⊕ C −1,4 (S) = E˜ (Sj) = Mj ⊕ Cj , u 0128 ǁJǁL 0128 ǁJǁL u u and (4) is satisfied by construction. Thus, the adversary always outputs 0 in the real world. In the ideal world, if = π, this condition is satisfied with probability 1/2128. Thus, the success probability of the attack is rae AEZ (A) = 1 − 1/2128, where makes 2 construction queries of length N + A + M , and has negligible time complexity.

Attack Exploiting Property (ii). Assume that I = 0128. Using Lemma 1 property (ii), we can perform the following distinguishing attack. – Let N, A, τ be any nonce, associated data, and tag size; – Let 0 l < 128. Let Mv, Mv′ 0, 1 A be any two distinct message blocks. Write Mu = Mv10∗ and Mu′ = Mv′10∗. Let Mxy 0, 1 256−1 be any message block. Write M = Mu Mv Mxy and M = Mu′ Mv′ Mxy; – Query C = 0(N, A, τ, M ) ∈ {0, 1}|M|+1 and C′ = 0(N, A, τ, M′) ∈