Abstract:

A partial  key recovery attack on SHA-0-MAC is presented, which is the first partial key recovery attack on SHA-0-MAC. SHA-0-MAC is a kind of MDx-MAC based on hash function SHA-0. MDx-MAC was first proposed by Preneel et al. in Crypto’95,which has 3 160-bit subkeys K0, K1, K2. 160-bit K0 can be fully recovered, and 128 bits of the subkey K1 with 2^125.58 MAC queries. By using Wang’s new methods of partial key recovery of MD5-MAC and a special pseudo collision differential path given by Biham et al., the sufficient conditions are deduced which make the differential path hold.
 

Key words: MDx-MAC; SHA-0; key recovery