2
$\begingroup$

I am studying the message authentication codes introduced in this paper. These MACs are linear in the sense that, if $f(m,k)$ denotes the tag appended to the message $m$ when the agreed upon key is $k$, then the mapping $f$ is linear in the second argument, for any fixed value of the first (it is understood that the key space and the tag space are vector spaces). This paper has inspired a lot of work in coding theory (the so-called subspace codes), but linear MACs seem not to have been studied further in cryptography. For that reason, I was wondering if they have any known weaknesses? And also, have they been used in any applications?

$\endgroup$

1 Answer 1

2
$\begingroup$

This idea goes back to Gilbert, MacWilliams and Sloane, and is described in the following answer here. The paper you refer to by no means is the originator of the idea.

The use case is a single use authentication tag, which means that linearity is not a hindrance, and the fact that linear maps are equidistributed under mild conditions is what makes the authentication not leak any more information than the minimal possible. This gives so called "perfect integrity" in terms of modification detection.

This type of use, to the best of my knowledge, is somewhat similar to how HMAC and related primitives are used. Those are more concretely based on hard problems and may be more efficient to deploy.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.