1

This question is in regards to "A Graduate Course in Applied Cryptography" by Boneh-Shoup, section 6.4.1 "The CBC prefix-free secure PRF".

In the proof for the security strength of prefix free CBC construction, they introducing the component $${{(Ql)}^2 \over (2|\mathcal{X}|)}$$ which considers the probability of collision in any intermediate stage, while the attacker is only exposed to the outcome of the last stage.

This means that in order for attack to happen, the collision not only needs to be in some intermediate location, but also in the exact same location in the tree, with seemingly probability much smaller than the above.

How can this be explained?

Maarten Bodewes
  • 96,351
  • 14
  • 169
  • 323
Evgeni Vaknin
  • 1,155
  • 8
  • 20

1 Answers1

1

why are all possible collisions taken into account while calculating the probability of collision, while only few of them really matters, those that happen in the last leaf.

Collisions in the center matter because they can happen, and with proper strategy can be turned into an attack against the iterated PRF of ยง6.4.1

One attack strategy is submitting long multi-block messages differing only in the first block, until the output of the PRF matches for two messages. Notice that in this setup a collision can happen at any block, and will always propagate to the output, making it detectable. Then there is high probability $1-1/\ell$ that changing the last block still leads to a collision (and otherwise we know that the collision is in the last block, which can be exploited with two additional queries). For $n$-bit block thus $|\mathcal{X}|=2^n$, with $Q$ queries of messages each $\ell$ blocks, the probability of observable collision is about $\frac{\ell\,Q^2}{2|\mathcal{X}|}$. That's a fair strategy if we only count the number of queries $Q$ in an attack and discount the cost of larger messages.

Notice that the strategy in the above paragraph assumes a PRF as the function iterated, like in the reference. It won't work with a PRP such as in AES-CBC-MAC (built from the question's PRF and a final encryption step with a different key, as in ISO/IEC 9797-1 MAC algorithm 2), because there will never be any collision.


Addition: The above is a simple illustration that a strategy can take advantage of at least some internal collisions. As noted in comment, it does not take advantage of most such collisions. But there is no argument made that the strategy is optimal. The reference has $\frac{\ell^2\,Q^2}{2|\mathcal{X}|}$ because it's about getting an upper bound of the probability that any collision occurs, regardless of strategy.

fgrieu
  • 149,326
  • 13
  • 324
  • 622