Replacing SHA-2 with SHA-3 Enhances Generic Security of HMAC

摘要

In this paper, we study the MAC- and the PRF-security of HMAC in the sense of generic security when replacing SHA-2 with SHA-3. We first consider the generic security of the SHA-3-based HMAC construction: Sponge-based HMAC. We provide (nearly) tight upper-bounds on the MAC- and the PRF-security of Sponge-based HMAC, which are O(nq/2~n) and O(q~2/2~n), respectively. Here, q is the number of queries to HMAC and n is the output length of the hash function. We then compare the MAC- and the PRF-security of Sponge-based HMAC with those of the SHA-2-based HMAC constructions: MD- (Merkle-Damgard) or ChopMD-based HMAC. It was proven that the upper-bounds on the MAC- and the PRF-security of MD-based HMAC are both O(lq~2/2~n), and those for ChopMD-based HMAC are both O(q~2/2~n + lq~2/2~(n+t)). Here, q is the number of queries to HMAC, l is the maximum query length, n is the output length of the hash function, and t is the number of truncated bits in ChopMD. Hence, replacing SHA-2 with SHA-3 enhances the MAC-security of HMAC. Replacing SHA-2 having the MD construction with SHA-3 enhances the PRF-security of HMAC, and if l ＞ 2~t then replacing SHA-2 having the ChopMD construction with SHA-3 enhances the PRF-security of HMAC.