Attack Beyond-Birthday-Bound MACs in Quantum Setting

The security in the quantum setting of a series of message authentication codes (MACs) with provable beyond-birthday-bound (BBB) security is analyzed in this paper, including SUM-ECBC, PolyMAC, PMAC Plus, 3kf9 and some variants (2K-ECBC Plus, GCM-SIV2, 1kPMAC Plus, 2K-PMAC Plus and PMAC TBC3k). All these MACs have a security proof up to 2 (even 2) queries assuming the block size of the underlying (tweakable) block cipher is n bits. Given that the adversary can make quantum queries, we consider secret state recovery and partial key recovery attacks against these MACs. Both attacks lead to successful forgeries. For the first one, we apply Grover-meetSimon algorithm to recover some secret states of SUM-ECBC, PolyMAC, PMAC Plus, 3kf9 and so on. Our research shows this forgery attack costs at most O(2n) quantum queries using at most O(n) qubits. For the second one, we apply Grover’s algorithm to recover partial keys of PMAC Plus, 3kf9, PMAC TBC3k and so on. Our research shows this forgery attack costs O(2) quantum queries and O(m + n) qubits assuming the size of one key is m bits. As far as we know, these are the first quantum attacks against BBB MACs. Our results show that in the quantum setting their securities go back to birthday bounds.