# Corrigendum to Fast AES-Based Universal Hash Functions and MACs

Augustin Bariant, Jules Baudrin, Gaëtan Leurent, Clara Pernot, Léo Perrin, Thomas Peyrin

► To cite this version:

Augustin Bariant, Jules Baudrin, Gaëtan Leurent, Clara Pernot, Léo Perrin, et al. Corrigendum to Fast AES-Based Universal Hash Functions and MACs. IACR Transactions on Symmetric Cryptology, 2025, 2025 (1), pp.623-628. 10.46586/tosc.v2025.i1.623-628. hal-05468291

HAL Id: hal-05468291

https://inria.hal.science/hal-05468291v1

Submitted on 20 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
# Corrigendum to Fast AES-Based Universal Hash Functions and MACs

Augustin Bariant<fnref n="1" />,<fnref n="2" />, Jules Baudrin<fnref n="1" />,<fnref n="3" />, Gaëtan Leurent<fnref n="1" />, Clara Pernot<fnref n="1" />, Léo Perrin<fnref n="1" /> and Thomas Peyrin<fnref n="4" />

**Abstract.** In ToSC 2024(2), Bariant *et al.* proposed a new framework for designing efficient AES-based Universal Hash Functions (UHFs) and Message Authentication Codes (MACs). They proposed two MAC instances aiming for 128-bit security, PetitMac and LeMac, based on two different UHF candidates. The security of the UHF candidates was evaluated with Mixed Integer Linear Programming (MILP) modeling, to find the minimum number of active S-boxes in differential trails from a non-zero message difference to a zero state difference. The designers claimed at least 26 active S-boxes for the UHF of LeMac.

In this corrigendum, we point out that there was a mistake when writing the LeMac specification from the MILP model. The UHF candidate of LeMac presented in the paper does not correspond to the construction analysed with the MILP solver. In particular, the erroneous candidate only guarantees 25 active S-boxes rather than 26. Therefore, we propose to rename the candidate from the original paper to LeMac-0, and propose a fixed version of LeMac, with the correct underlying UHF candidate. The change of specification of LeMac is motivated by the fact that the new specification possesses better security guarantees than LeMac-0 for similar performances.

**Keywords:** Universal hash function · MAC · AES · authentication · LeMac

# 1 Introduction

In [BBL+24], the authors introduced a framework of fast AES-based UHFs, exploiting the speed of AES-NI with maximum throughput with parallel AES rounds. In this framework, the performance and the security of the candidates can be automatically evaluated. On the one hand, the performance is measured by generating a C implementation, compiling, and benchmarking in an automatic manner. On the other hand, the security of the candidates is analyzed by computing the minimum number of active S-boxes in any differential trail with non-zero message difference leading to a collision in output, using MILP modeling. In Section 6 of [BBL+24], Bariant *et al.* presented a strategy to generate UHF candidates which are both secure and performant. Following an automated search, they proposed two concrete MAC candidates, LeMac and PetitMac, using the EWCDM construction [CS16] to convert a UHF into a MAC.

We found out that the original paper [BBL+24] wrongfully depicted the UHF candidate that was found during the search (Figure 2, Figure 4, and Algorithm 2 of [BBL+24]). The errors are consistent throughout the paper and the corresponding candidate also belongs

<footnote n="1">¹ Inria, Paris, France</footnote>

<footnote>name.surname@inria.fr</footnote>

<footnote n="2">² ANSSI, Paris, France</footnote>

<footnote n="3">³ UCLouvain, Louvain-La-Neuve, Belgium</footnote>

<footnote>jules.baudrin@uclouvain.be</footnote>

<footnote n="4">⁴ Nanyang Technological University, Singapore, Singapore</footnote>

<footnote>thomas.peyrin@ntu.edu.sg</footnote>
$$L = \begin{bmatrix} 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 1 & 0 & 0 & 0 & 0 & 1 \\ 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\ 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \end{bmatrix} \quad T = \begin{bmatrix} 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\ 1 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\ 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 \\ 0 & 1 & 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \end{bmatrix} \quad A = (110111111) \quad r = 3 \ s = 9 \ m = 4.$$

(a) Framework parameters of the UHF used in LeMac-0.

$$L = \begin{bmatrix} 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 \\ 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\ 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \end{bmatrix} \quad T = \begin{bmatrix} 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\ 1 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\ 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 1 & 1 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \end{bmatrix} \quad A = (110111111) \quad r = 4 \ s = 9 \ m = 4.$$

(b) Framework parameters of the UHF used in LeMac.

<caption>Figure 1: Comparison of framework parameters of LeMac and LeMac-0.</caption>

to the framework, but with different security guarantees. The mistake came from a wrong reconstruction of the specification from the MILP parameters, where the message schedule is shifted by one round. We propose to rename the erroneous MAC of the original paper into LeMac-0, and propose new specifications for LeMac, actually corresponding to the best candidate identified during the search. This error does not affect the other candidates of [BBL$^{+}$24, Table 2], whose specification, performance and security are correct.

## 2 LeMac versus LeMac-0

The parameters of the best MILP model identified during the parameter search explained in [BBL$^{+}$24] are shown in Figure 1b, with the notations of the framework from [BBL$^{+}$24]. The corresponding specification of LeMac is given in Figure 2b and Algorithm 2. For comparison, the erroneous specification of LeMac-0 is given in Figure 2a and Algorithm 1.

The difference lies in the message schedule: the message addition was wrongly performed before the wire rotation in LeMac-0 (in particular, this allows to reduce the memory size $r$ in the message schedule from 4 to 3). In the true LeMac however, the message addition is performed after the wire rotation.

**Security of LeMac-0.** While LeMac-0 is not the result of the parameter search in the original paper, it also belongs to the framework, with the parameters of Figure 1a. In particular, we can use the original MILP model to study its security. We found that LeMac-0 guarantees at least 25 active S-boxes, while LeMac guarantees 26 active S-boxes. Moreover, when removing constraints based on linear incompatibilities in the MILP model, LeMac still guarantees 24 active S-boxes while LeMac-0 only guarantees 20. Although the trails with 24/20 active S-boxes on LeMac/LeMac-0 are not instantiable because of linear incompatibilities, the bound of 20 for LeMac-0 lead us to reconsider our claims. Therefore, we claim 128-bit security on LeMac, but do not claim 128-bit security anymore on LeMac-0 because the security margin seems too low. However, we do not know of any attack on LeMac-0; we still expect it to be secure and consider it as an interesting candidate to study, as it can give deeper insights on the security of LeMac.

**Performance of LeMac.** The reference implementation<fnref n="1" /> has been updated to match the correct specification. The benchmark results in Table 4 of the original paper measure

<footnote n="1">¹https://github.com/AugustinBariant/Implementations_LeMac_PetitMac</footnote>
<figure><img src="image_2.png" /><figcaption>**Figure 2:** Comparison of the round functions of LeMac and LeMac-0.
The state wires were permuted for more readability, compared to the framework candidates presented in Figure 1, according to the permutation {2,3,4,5,0,8,1,6,7}.</figcaption></figure>
**Algorithm 1 LeMac-0.**

▷ Key derivation

Kinit ← (AES<sub>K</sub>(0), ..., AES<sub>K</sub>(8))

Kfinal ← (AES<sub>K</sub>(9), ..., AES<sub>K</sub>(26))

$k_2 \leftarrow AES_K(27)$

$k_3 \leftarrow AES_K(28)$

▷ UHF

$X^0 \leftarrow Kinit$

$R^0 \leftarrow (0, 0, 0)$

▷ Padding

$\ell \leftarrow [(\text{bitlen}(M) + 1)/512]$

$M_0, ..., M_{4\ell-1} \leftarrow M \parallel 10^*$

$M_{4\ell}, ..., M_{4\ell+11} \leftarrow 0$

for all $0 \le i < \ell + 3$ do

$X_0^{i+1} \leftarrow X_0^i + X_8^i$

for all $1 \le j < 9$ do

$X_j^{i+1} \leftarrow A(X_{j-1}^i)$

end for

$X_0^{i+1} \leftarrow X_0^{i+1} + M_{4i+2}$

$X_1^{i+1} \leftarrow X_1^{i+1} + M_{4i+3}$

$X_2^{i+1} \leftarrow X_2^{i+1} + M_{4i+3}$

$X_3^{i+1} \leftarrow X_3^{i+1} + R_1^i + R_2^i$

$X_4^{i+1} \leftarrow X_4^{i+1} + M_{4i}$

$X_5^{i+1} \leftarrow X_5^{i+1} + M_{4i}$

$X_6^{i+1} \leftarrow X_6^{i+1} + M_{4i+1}$

$X_7^{i+1} \leftarrow X_7^{i+1} + M_{4i+1}$

$X_8^{i+1} \leftarrow X_8^{i+1} + M_{4i+3}$

$R_0^{i+1} \leftarrow M_{4i+2}$

$R_1^{i+1} \leftarrow R_0^i + M_{4i+1}$

$R_2^{i+1} \leftarrow R_1^i$

end for

for all $0 \le j < 9$ do

for all $0 \le i < 10$ do

$X_j^{i+3+i+1} \leftarrow A(X_j^{i+3+i} + \text{Kfinal}_{i+j})$

end for

end for

$h \leftarrow \sum_{j=0}^{8} X_j^{\ell+13}$

▷ EWCDM

return AES<sub>k3</sub> (h + AES<sub>k2</sub>(N) + N)

**Algorithm 2 LeMac.**

▷ Key derivation

Kinit ← (AES<sub>K</sub>(0), ..., AES<sub>K</sub>(8))

Kfinal ← (AES<sub>K</sub>(9), ..., AES<sub>K</sub>(26))

$k_2 \leftarrow AES_K(27)$

$k_3 \leftarrow AES_K(28)$

▷ UHF

$X^0 \leftarrow Kinit$

$R^0 \leftarrow (0, 0, 0, 0)$

▷ Padding

$\ell \leftarrow [(\text{bitlen}(M) + 1)/512]$

$M_0, ..., M_{4\ell-1} \leftarrow M \parallel 10^*$

$M_{4\ell}, ..., M_{4\ell+15} \leftarrow 0$

for all $0 \le i < \ell + 4$ do

$X_0^{i+1} \leftarrow X_0^i + X_8^i$

for all $1 \le j < 9$ do

$X_j^{i+1} \leftarrow A(X_{j-1}^i)$

end for

$X_0^{i+1} \leftarrow X_0^{i+1} + M_{4i+2}$

$X_1^{i+1} \leftarrow X_1^{i+1} + M_{4i+3}$

$X_2^{i+1} \leftarrow X_2^{i+1} + M_{4i+3}$

$X_3^{i+1} \leftarrow X_3^{i+1} + R_2^i + R_3^i$

$X_4^{i+1} \leftarrow X_4^{i+1} + M_{4i}$

$X_5^{i+1} \leftarrow X_5^{i+1} + M_{4i}$

$X_6^{i+1} \leftarrow X_6^{i+1} + M_{4i+1}$

$X_7^{i+1} \leftarrow X_7^{i+1} + M_{4i+1}$

$X_8^{i+1} \leftarrow X_8^{i+1} + M_{4i+3}$

$R_0^{i+1} \leftarrow M_{4i+2}$

$R_1^{i+1} \leftarrow R_0^i + M_{4i+1}$

$R_2^{i+1} \leftarrow R_1^i$

$R_3^{i+1} \leftarrow R_2^i$

end for

for all $0 \le j < 9$ do

for all $0 \le i < 10$ do

$X_j^{i+3+i+1} \leftarrow A(X_j^{i+3+i} + \text{Kfinal}_{i+j})$

end for

end for

$h \leftarrow \sum_{j=0}^{8} X_j^{\ell+13}$

▷ EWCDM

return AES<sub>k3</sub> (h + AES<sub>k2</sub>(N) + N)

the performance of LeMac-0 and not of LeMac, but the performance differences between LeMac and LeMac-0 are marginal.

## Acknowledgments

The authors would like to thank Quentin Rataud for pointing out this mistake. This work was supported by the bilateral NRF/ANR grant SELECT (NRF-NRFI08-2022-0013/ANR-20-CE48-0017). Thomas Peyrin is supported by the Singapore NRF Investigatorship grant (NRF-NRFI08-2022-0013). Léo Perrin is supported by the European Research Council (ERC, grant agreement no. 101041545 “ReSCALE”). This work was also supported by project Cryptanalyse from PEPR Cybersécurité (22-PECY-0010).
<table><caption>**Table 1: Benchmark results.**</caption><thead><tr><th rowspan="2">CPU</th><th rowspan="2">Cipher</th><th colspan="3">Speed (c/B)</th></tr><tr><th>1kB</th><th>16kB</th><th>256kB</th></tr></thead><tbody><tr><td rowspan="8">Intel Haswell (Xeon E5-2630 v3)</td><td>GCM (AD only)</td><td>1.175</td><td>0.716</td><td>0.637</td></tr><tr><td>Rocca (AD only) 0.604</td><td>0.225</td><td>0.201</td><td></td></tr><tr><td>Rocca-S (AD only)</td><td>0.656</td><td>0.291</td><td>0.269</td></tr><tr><td>AEGIS128 (AD only)</td><td>0.818</td><td>0.579</td><td>0.564</td></tr><tr><td>AEGIS128L (AD only)</td><td>0.560</td><td>0.304</td><td>0.288</td></tr><tr><td>Tiaoxin-346 v2 (AD only)</td><td>0.494</td><td>0.209</td><td>0.194</td></tr><tr><td>Jean-Nikolić</td><td>0.451</td><td>0.147</td><td>0.136</td></tr><tr><td>LeMac-0</td><td>0.448</td><td>0.145</td><td>0.137</td></tr><tr><td rowspan="2">Intel Skylake (Xeon Gold 6130)</td><td>LeMac</td><td>0.460</td><td>0.146</td><td>0.128</td></tr><tr><td>PetitMac</td><td>1.125</td><td>0.891</td><td>0.876</td></tr><tr><td rowspan="8">Intel Ice Lake (Xeon Gold 5320)</td><td>GCM (AD only)</td><td>0.883</td><td>0.448</td><td>0.414</td></tr><tr><td>Rocca (AD only)</td><td>0.503</td><td>0.187</td><td>0.166</td></tr><tr><td>Rocca-S (AD only)</td><td>0.497</td><td>0.210</td><td>0.190</td></tr><tr><td>AEGIS128 (AD only)</td><td>0.668</td><td>0.472</td><td>0.458</td></tr><tr><td>AEGIS128L (AD only)</td><td>0.491</td><td>0.266</td><td>0.252</td></tr><tr><td>Tiaoxin-346 v2 (AD only)</td><td>0.476</td><td>0.207</td><td>0.189</td></tr><tr><td>Jean-Nikolić</td><td>0.395</td><td>0.142</td><td>0.126</td></tr><tr><td>LeMac-0</td><td>0.372</td><td>0.141</td><td>0.126</td></tr><tr><td rowspan="2">AMD Zen1 (EPYC 7301)</td><td>LeMac</td><td>0.383</td><td>0.141</td><td>0.126</td></tr><tr><td>PetitMac</td><td>0.799</td><td>0.636</td><td>0.626</td></tr><tr><td rowspan="8">AMD Zen3 (EPYC 7513)</td><td>GCM (AD only)</td><td>0.737</td><td>0.345</td><td>0.321</td></tr><tr><td>Rocca (AD only)</td><td>0.438</td><td>0.167</td><td>0.149</td></tr><tr><td>Rocca-S (AD only)</td><td>0.392</td><td>0.165</td><td>0.151</td></tr><tr><td>AEGIS128 (AD only)</td><td>0.586</td><td>0.401</td><td>0.389</td></tr><tr><td>AEGIS128L (AD only)</td><td>0.393</td><td>0.207</td><td>0.195</td></tr><tr><td>Tiaoxin-346 v2 (AD only)</td><td>0.346</td><td>0.134</td><td>0.123</td></tr><tr><td>Jean-Nikolić</td><td>0.298</td><td>0.137</td><td>0.110</td></tr><tr><td>LeMac-0</td><td>0.274</td><td>0.083</td><td>0.074</td></tr><tr><td rowspan="2">AMD Zen3 (EPYC 7513)</td><td>LeMac</td><td>0.285</td><td>0.092</td><td>0.079</td></tr><tr><td>PetitMac</td><td>0.522</td><td>0.384</td><td>0.376</td></tr><tr><td rowspan="8">AMD Zen1 (EPYC 7301)</td><td>GCM (AD only)</td><td>0.932</td><td>0.567</td><td>0.538</td></tr><tr><td>Rocca (AD only)</td><td>0.424</td><td>0.140</td><td>0.122</td></tr><tr><td>Rocca-S (AD only)</td><td>0.438</td><td>0.159</td><td>0.142</td></tr><tr><td>AEGIS128 (AD only)</td><td>0.509</td><td>0.325</td><td>0.376</td></tr><tr><td>AEGIS128L (AD only)</td><td>0.373</td><td>0.193</td><td>0.181</td></tr><tr><td>Tiaoxin-346 v2 (AD only)</td><td>0.354</td><td>0.145</td><td>0.131</td></tr><tr><td>Jean-Nikolić</td><td>0.339</td><td>0.127</td><td>0.111</td></tr><tr><td>LeMac-0</td><td>0.298</td><td>0.089</td><td>0.075</td></tr><tr><td rowspan="2">AMD Zen3 (EPYC 7513)</td><td>LeMac</td><td>0.319</td><td>0.097</td><td>0.083</td></tr><tr><td>PetitMac</td><td>0.683</td><td>0.511</td><td>0.501</td></tr><tr><td rowspan="8">AMD Zen3 (EPYC 7513)</td><td>GCM (AD only)</td><td>0.816</td><td>0.479</td><td>0.466</td></tr><tr><td>Rocca (AD only)</td><td>0.392</td><td>0.140</td><td>0.124</td></tr><tr><td>Rocca-S (AD only)</td><td>0.413</td><td>0.158</td><td>0.141</td></tr><tr><td>AEGIS128 (AD only)</td><td>0.498</td><td>0.338</td><td>0.329</td></tr><tr><td>AEGIS128L (AD only)</td><td>0.358</td><td>0.183</td><td>0.174</td></tr><tr><td>Tiaoxin-346 v2 (AD only)</td><td>0.311</td><td>0.120</td><td>0.109</td></tr><tr><td>Jean-Nikolić</td><td>0.301</td><td>0.111</td><td>0.098</td></tr><tr><td>LeMac-0</td><td>0.270</td><td>0.082</td><td>0.070</td></tr><tr><td rowspan="2">AMD Zen3 (EPYC 7513)</td><td>LeMac</td><td>0.272</td><td>0.085</td><td>0.069</td></tr><tr><td>PetitMac</td><td>0.669</td><td>0.511</td><td>0.501</td></tr></tbody></table>
References

[BBL+24] Augustin Bariant, Jules Baudrin, Gaëtan Leurent, Clara Pernot, Léo Perrin, and Thomas Peyrin. Fast AES-based universal hash functions and MACs featuring LeMac and PetitMac. *IACR Trans. Symm. Cryptol.*, 2024(2):35–67, 2024.

[CS16] Benoît Cogliati and Yannick Seurin. EWCDM: An efficient, beyond-birthday secure, nonce-misuse resistant MAC. In Matthew Robshaw and Jonathan Katz, editors, *CRYPTO 2016, Part I*, volume 9814 of LNCS, pages 121–149, August 2016.