Paper 2001/027

PMAC

Phillip Rogaway and John Black

Abstract

This paper was prepared for NIST, which is considering new block-cipher modes of operation. Given an arbitrary block cipher, we define based on it a simple, deterministic, and parallelizable message authentication code. Our algorithm, PMAC, uses just $\lceil |M|/n\rceil$ block-cipher invocations to authenticate a message~$M$, where $n$ is the blocksize of the block cipher. Preprocessing and additional overhead is minimal. We provide a full security analysis for PMAC, quantifying the adversary's forgery probability in terms of the quality of the block cipher as a PRP.