Abstract. In this paper, we present the first distinguishing attack on HMAC and NMAC based on MD5 without related keys, which distinguishes the HMAC/NMAC-MD5 from HMAC/NMAC with a random function. The attack needs 2 97 queries, with a success probability 0.87, while the previous distinguishing attack on HMAC-MD5 reduced to 33 rounds takes 2 126.1 messages with a success rate of 0.92. Furthermore, we give distinguishing and partial key recovery attacks on MDx-MAC based on MD5. The MDx-MAC was proposed by Preneel and van Oorschot in Crypto'95 which uses three subkeys derived from the initial key. We are able to recover one 128-bit subkey with 2 97 queries.
Wang et al. REF introduced another interesting idea which can distinguish HMAC/NMAC-MD5 without the related-key setting and implement partial key recovery attack on MD5-MAC.
Cryptanalysis on HMAC/NMAC-MD5 and MD5-MAC
EUROCRYPT
Computer Science