Distinguishing Attack and Second-Preimage Attack on Encrypted Message Authentication Codes (EMAC)

摘要

In this paper we show that distinguisher on CBC-MAC can be applied to Encrypted Message Authentication Code (EMAC) scheme. EMAC scheme in general is vulnerable to distinguishing attack and second preimage attack. Distinguishing attack simulation on AES-EMAC using 2~(25) message modifications, no collision have been found. According to second preimage attack simulation on AES-EMAC no collision found between EMAC value of S_1 and S_2, i.e. no second preimage found for messages that have been tested. Based on distinguishing attack simulation on truncated AES-EMAC we found collision in every message therefore we cannot distinguish truncated AES-EMAC with random function. Second-preimage attack is successfully performed on truncated AES-EMAC.