Keyed hash function from large girth expander graphs

TL;DR

This paper introduces a new keyed hash function based on large girth expander graphs, offering flexible output lengths, high efficiency, and strong mixing properties suitable for message authentication.

Contribution

The paper presents a novel MAC construction using expander graphs with large girth, providing flexible output lengths and efficient implementation.

Findings

Achieves 4 operations per input bit.

Outputs are indistinguishable from random bits.

Supports messages of arbitrary length.

Abstract

In this paper we present an algorithm to compute keyed hash function (message authentication code MAC). Our approach uses a family of expander graphs of large girth denoted $D(n,q)$, where $n$ is a natural number bigger than one and $q$ is a prime power. Expander graphs are known to have excellent expansion properties and thus they also have very good mixing properties. All requirements for a good MAC are satisfied in our method and a discussion about collisions and preimage resistance is also part of this work. The outputs closely approximate the uniform distribution and the results we get are indistinguishable from random sequences of bits. Exact formulas for timing are given in term of number of operations per bit of input. Based on the tests, our method for implementing DMAC shows good efficiency in comparison to other techniques. 4 operations per bit of input can be achieved. The algorithm is very flexible and it works with messages of any length. Many existing algorithms output a fixed length tag, while our constructions allow generation of an arbitrary length output, which is a big advantage.

Tables

Table 1. Table 1: Example n 𝑛 n values for fixed tag size h ℎ h and coding

		UTF-8	UTF-16	UTF-32
$h$	$2^7=128$ bits	$2^7=n{2}^3\Rightarrow n=2^4$	$2^7=n{2}^4\Rightarrow n=2^3$	$2^7=n{2}^5\Rightarrow n=2^2$
	$2^8=256$ bits	$n=2^5$	$n=2^4$	$n=2^3$
	$2^9=512$ bits	$n=2^6$	$n=2^5$	$n=2^4$
	$2^{10}=1024$ bits	$n=2^7$	$n=2^6$	$n=2^5$

Table 2. Table 2: Summary of the Tests

MAC type	Original Message	Output	$S$	IV
DMAC-1	The sky announced a beautiful day: the setting moon shane pale in an immense field of azure, which, towards the east, mingled itself lightly with the rosy dawn.	49 a7 df d0 58 51 6a 9d 4e 94 2d 43 2a b9 60 f2 ab 22 5a a8 18 13 20 7d f7 1 5f ad 21 3f 56 45	hint	[147, 217, 2582, 2976, 1718, 1599, 27, 1083, 471, 1461, 1076, 2255, 2875, 2696, 2793, 1015, 1477, 1271, 2856, 221, 961, 2839, 1789, 1845, 1157, 622, 758, 882, 210, 1846, 3009, 410]
	The sky …	2d 48 b6 e4 50 de 8b d2 2e b4 1b d fb 9f b6 63 a1 7b e2 ee 4 e7 b1 ed 88 25 51 ca c4 7d e3 36	hint	[149, 219, 2582, 2976, 1718, 1599, 27, 1083, 471, 1461, 1076, 2255, 2875, 2696, 2793, 1015, 1477, 1271, 2856, 221, 961, 2839, 1789, 1845, 1157, 622, 758, 882, 210, 1846, 3009, 410]
	The sky …	78 46 b2 50 81 c1 ba b2 c c4 e6 6c 7a 69 b4 fd c6 64 a 69 30 e0 4d 30 1e e7 9c 36 55 e d1 8a	hunt	[147, 217, 2582, 2976, 1718, 1599, 27, 1083, 471, 1461, 1076, 2255, 2875, 2696, 2793, 1015, 1477, 1271, 2856, 221, 961, 2839, 1789, 1845, 1157, 622, 758, 882, 210, 1846, 3009, 410]
	Da sky …	86 f8 16 c5 dd 100 28 d1 91 8f 48 3c ff 3a a6 e2 b1 31 23 91 17 73 64 86 be 6b 81 ad 5e 10 67 56	hint	[147, 217, 2582, 2976, 1718, 1599, 27, 1083, 471, 1461, 1076, 2255, 2875, 2696, 2793, 1015, 1477, 1271, 2856, 221, 961, 2839, 1789, 1845, 1157, 622, 758, 882, 210, 1846, 3009, 410]
DMAC-2	The sky announced a beautiful day…	6f ed d1 fb 2f cf 56 fc a9 5e c8 1d 90 ec f7 4a df 42 1a 1e 3b 16 62 54 90 81 a2 a4 7e 3f 8d db	red	[147, 217, 2582, 2976, 1718, 1599, 27, 1083, 471, 1461, 1076, 2255, 2875, 2696, 2793, 1015, 1477, 1271, 2856, 221, 961, 2839, 1789, 1845, 1157, 622, 758, 882, 210, 1846, 3009, 410]
	The sky …	59 9 c2 a b1 ba 88 1b 12 e7 f3 a 65 71 87 7b 25 c4 20 57 38 6e 54 b0 b8 19 74 5b d8 33 46 d	rid	[147, 217, 2582, 2976, 1718, 1599, 27, 1083, 471, 1461, 1076, 2255, 2875, 2696, 2793, 1015, 1477, 1271, 2856, 221, 961, 2839, 1789, 1845, 1157, 622, 758, 882, 210, 1846, 3009, 410]
	The sky …	d7 92 60 73 0 dd ef fa 6 3 f2 c6 9b 62 c6 58 e7 59 31 a5 2d 5e 34 67 7d a9 95 30 86 12 9a e0	red	[149, 221, 2582, 2976, 1718, 1599, 27, 1083, 471, 1461, 1076, 2255, 2875, 2696, 2793, 1015, 1477, 1271, 2856, 221, 961, 2839, 1789, 1845, 1157, 622, 758, 882, 210, 1846, 3009, 410]
	Da sky …	54 c7 8 d3 d9 fc c1 ed 57 18 9d 74 62 d2 5d 35 5a cd 15 3c b7 19 9a 3c 79 1d 4c 68 69 3b d8 6b	red	[147, 217, 2582, 2976, 1718, 1599, 27, 1083, 471, 1461, 1076, 2255, 2875, 2696, 2793, 1015, 1477, 1271, 2856, 221, 961, 2839, 1789, 1845, 1157, 622, 758, 882, 210, 1846, 3009, 410]

Equations

$$g_i\ge \gamma {\log }_{k-1}(v_i)$$

$$(\vec{p})=$$

$$[\vec{l}]=$$

$$\left\{\begin{array}[]{ll}l_{2}-p_{2}=l_{1}p_{1}\\ l_{3}-p_{3}=l_{2}p_{1}\\ l_{4}-p_{4}=l_{1}p_{2}\\ l_{i}-p_{i}=l_{1}p_{i-2}\\ l_{i+1}-p_{i+1}=l_{i-1}p_{1}\\ l_{i+2}-p_{i+2}=l_{i}p_{1}\\ l_{i+3}-p_{i+3}=l_{1}p_{i+1}\end{array}\right.$$

$$g(D(n,q))=\{\begin{array}{l}n+5,\text{ for odd }n\\ n+4,\text{ for even }n\end{array}$$

$$Q\ge 2^N.$$

$$N_t(\vec{w}=(w_1,w_2,\dots ,w_n))=[(w_1+t{)}^2,\underset{n-1}{\underbrace{\ast ,\dots ,\ast }}],$$

$$N_t(\vec{w}=[w_1,w_2,\dots ,w_n])=((w_1+t{)}^2,\underset{n-1}{\underbrace{\ast ,\dots ,\ast }}),$$

$$N_3(\vec{w}=(1,8,4,2,7,0))=[(1+3{)}^2,\ast ,\ast ,\ast ,\ast ,\ast ]$$

$$\left\{\begin{array}[]{ll}l_{2}-8=5\cdot 1\\ l_{3}-4=l_{2}\cdot 1\\ l_{4}-2=5\cdot 8\\ l_{5}-7=5\cdot 4\\ l_{6}-0=l_{4}\cdot 1\\ \end{array}\right.$$

$$s\le \frac{1}{2}g(D(n,Q)).$$

$$N_{M_i}(\overrightarrow{v_i}=(v_1^i,v_2^i,\dots ,v_n^i))=[(v_{i\text{mod}n+1}^i+M_i{)}^2\mathrm{mod}Q,\underset{n-1}{\underbrace{\ast ,\dots ,\ast }}],$$

$$N_{M_i}(\overrightarrow{v_i}=[v_1^i,v_2^i,\dots ,v_n^i])=((v_{i\text{mod}n+1}^i+M_i{)}^2\mathrm{mod}Q,\underset{n-1}{\underbrace{\ast ,\dots ,\ast }}),$$

$$N_{S_i}(\overrightarrow{v_i}=(v_1^i,v_2^i,\dots ,v_n^i))=[(v_{i\text{mod}n+1}^i+S_i{)}^2\mathrm{mod}Q,\underset{n-1}{\underbrace{\ast ,\dots ,\ast }}],$$

$$N_{S_i}(\overrightarrow{v_i}=[v_1^i,v_2^i,\dots ,v_n^i])=((v_{i\text{mod}n+1}^i+S_i{)}^2\mathrm{mod}Q,\underset{n-1}{\underbrace{\ast ,\dots ,\ast }}),$$

$$m_1=(0,28,1,4,0)$$

$$m_2=(20,19,8,5,20)$$

$$m_3=(11,28,30,24,0)$$

$$\begin{array}{rl}\overrightarrow{v_1}& =N_{M_1}(\overrightarrow{(}{v}_0)=[(v_1^0+M_1{)}^2\mathrm{mod}33554467,v_2^1,v_3^1]\\ & =[(5+28140{)}^2\mathrm{mod}33554467,v_2^1,v_3^1]\\ & =[20388284,1278029,6390172]\end{array}$$

$$\left\{\begin{array}[]{ll}v_{2}^{1}-10=20388284\cdot 5\\ v_{3}^{1}-27=v_{2}^{1}\cdot 5\\ \end{array}\right.$$

$$\overrightarrow{v_1}:=\overrightarrow{v_1}+\overrightarrow{v_0}=[20388289,1278039,6390199]$$

$$\begin{array}{rl}\overrightarrow{v_2}& =N_{M_2}(\overrightarrow{(}{v}_1)=((v_2^1+M_2{)}^2\mathrm{mod}33554467,v_2^2,v_3^2)\\ & =((1278039+20198520{)}^2\mathrm{mod}33554467,v_2^2,v_3^2)\\ & =(30968786,21891813,29421730)\end{array}$$

$$\left\{\begin{array}[]{ll}1278039-v_{2}^{2}=20388289\cdot 30968786\\ 6390199-v_{3}^{2}=1278039\cdot 30968786\\ \end{array}\right.$$

$$\overrightarrow{v_2}:=\overrightarrow{v_2}+\overrightarrow{v_1}=(17802608,23169852,2257462)$$

$$\begin{array}{rl}\overrightarrow{v_3}& =N_{M_3}(\overrightarrow{(}{v}_2)=[(v_3^2+M_3{)}^2\mathrm{mod}33554467,v_2^3,v_3^3]\\ & =[(2257462+112830240{)}^2\mathrm{mod}33554467,v_2^3,v_3^3]\\ & =[14009975,4873348,10691714]\end{array}$$

$$\left\{\begin{array}[]{ll}v_{2}^{3}-23169852=14009975\cdot 17802608\\ v_{3}^{3}-2257462=v_{2}^{3}\cdot 17802608\\ \end{array}\right.$$

$$\overrightarrow{v_3}:=\overrightarrow{v_3}+\overrightarrow{v_2}=[31812583,28043200,12949176]$$

$$\overrightarrow{v_6}:=(\overrightarrow{v_6}+\overrightarrow{v_5})\mathrm{mod}29=h.$$

$$h⩽n\cdot l(q).$$

$$512=8n\Rightarrow 2^9=2^{3}n\Rightarrow n=64.$$

$$Q\ge 2^{32}\Rightarrow Q=2^{32}.$$

Full text

1 Introduction

Our work is motivated by the work of Charles, Goren and Lauter, [6]. They proposed the construction of collision resistant hash function from expander graphs. The family of graphs they used were Ramanujan graphs constructed by Lubotzky, Philips and Sarnak (see [18]) and Pizer’s Ramanujan graphs, [23]. Hash functions from LPS require 7 field multiplications per bit of input, but the field size may need to be bigger (1024 bit prime p instead of 256 bits, for example), and the output is $4log(p)$ bits. When the hash function from Pizer’s graph $G(p,l)$, for $l=2$, requires $2log(p)$ field multiplications per bit of input, which is quite inefficient (the authors propose to use a graph of cryptographic size $p\approx 2^{256}$). The output of this hash function is $log(p)$ bits. The idea presented in [6] is very good, but collisions for this hash were found (see [26]). However, expander graphs can be used to produce keyed hash function (message authentication code). When secret parameters are involved (like colouring and initial vertex) the adversary cannot find collision with mentioned method.

We propose a construction of message authentication code based on another family of expander graphs $D(n,q)$ of large girth, [16]. The most important advantages are: the output can have arbitrary length (like in case of variants of SHA-3: SHAKE128 and SHAKE256), max message size is unlimited and the performance is very good (4 field operations per bit of input can be achieved). Another advantage of our construction is that graphs from the family $D(n,q)$ have a nice representation by vectors and incidence relations are described by system of multivariate equations, which is very easy to implement. From the other side such systems of nonlinear equations are used for multivariate cryptography that is considered to be a good candidate for a post-quantum cryptography, [10].

The basics about hash function and keyed hash function (message authentication code; MAC) can be found in [25]. A hash function accepts a message $M$ as input and produces a fixed-size hash value $h=H(M)$. Hash functions are often used to determine whether or not data has changed. In general terms, the main goal of a hash function is to ensure data integrity.However it can be also used for authentication, to create one way password files, as a source of pseudorandom numbers (bits) or for intrusion and virus detection. A cryptographic hash function is a function that is acceptable for security applications. It means that it shall be computationally infeasible to find

i

a $x$ that is the preimage of $h$ for a hash value $h=H(x)$ (one way property),

ii

two data objects $x\neq y$, for which $H(x)=H(y)$ (the collision-free property).

In addition, a good hash function has the property that the output looks like random data and even a small change in input causes big changes in the output.

It is possible to use a hash function but no encryption for a message authentication. There are a few techniques to achieve this: use hash function + encryption on the hash, compute a hash value over the concatenation of $M$ and $S$ (a common secret value) and append the resulting hash value to the message or use keyed hash function. There are many reasons why it is worth to use techniques that avoid encryption [12]. For example, if there is no need to keep message confident but we want to authenticate it, those techniques are faster.

Figure  1 illustrates the mechanism for message authentication using keyed hash function. In order to check the integrity of the message, the keyed hash function is applied to the message and the result is compared with the associated tag. The secret key $K_{s}$ is known for the receiver and for the sender, so the sender can be easily verified. The MAC approach guarantees data integrity and authenticity.

2 Background

Graphs of large girth

We define the girth of a graph as the length of the shortest cycle. In the analyzed context girth is a very important property of the graph. Let $\{G_{i}\}_{i\in\mathbb{N}}$ be a family of $k$-regular graphs with increasing order. Let $g_{i}$ and $v_{i}$ denote respectively the girth and the order of the graph $G_{i}$. A family of graphs with increasing girth is a sequence of graphs such that $g_{i}\leq g_{j}$ for $i<j$. According to the definition introduced in [1], we say that a family of $k$-regular graphs is a family of graphs of large girth if

[TABLE]

for a constant $\gamma$ and all $i\geq 1$.

A nice survey about graphs of large girth is presented in [2]. It is known that $\gamma=2$ (see [5]) is the best possible constant, but there is no explicit construction of such family of graphs for which it can be obtained. This topic started in 1959 when Paul Erdős proved existence of such families with bounded degree $k$ and $\gamma=1/4$, without providing a construction [7]. There have been numerous investigations of the field by several authors. However, until 2017 the list of major known results is short. The list of explicit constructions is the following:

the first explicit construction of such family with $\gamma=0.44$, denoted by $X(p,q)$, where $p$ and $q$ are primes was introduced by G. A. Margulis in 1982 [19], 2. 2.

generalisation of the family $X(p,q)$ proposed by M. Morgenstern [22], 3. 3.

constructions for arbitrary $k$ with $\gamma=0.48$ and construction of family of 3-regular graphs with $\gamma=0.96$ obtained by V. Imrich in 1983 [13], 4. 4.

family of sextet graphs introduced in 1983 by Biggs and Hoare [4] (Alfred Weiss [33] proved that $\gamma=\frac{4}{3}$), 5. 5.

second construction by G. A. Margulis in 1988 [20], 6. 6.

constructions of cubic graphs, presented in a popular article [2], 7. 7.

construction by Lubotzky, Phillips and Sarnak [18] (Biggs and Boshier [3] proved that $\gamma=\frac{4}{3}$ for this family of graphs), 8. 8.

algebraic graphs $CD(n,q)$ given by the nonlinear system of equations over finite field $\mathbb{F}_{q}$, with $\gamma\geq\log_{q}(q-1)$, [15] (Furedi [8] proved that for arbitrary prime power $q$: $\gamma=log_{q}(q-1)$), 9. 9.

the polarity graphs of $CD(n,q)$ (see [17]) has an induced subgraph of degree $q-1$ which is a family of graphs of large girth (it is shown in [31]).

Expander graphs

An important property that a family of graphs must have in order to be a good candidate for a construction of a hash function is to be a family of expander graphs. Cryptographic hash function from expander graphs were presented in works of [27, 35, 6].

Let’s consider a spectrum of a graph with eigenvalues $\lambda_{0}>\lambda_{1}>...>\lambda_{s-1}$. A family of $k$-regular graphs of increasing order $\{G_{i}\}_{i\in\mathbb{N}}$ is called a family of Ramanujan graphs if $|\lambda_{1}(G_{i})|\leq 2\sqrt{k-1}$ for all $i$ ([11], p. 452). If $k$ is stable and $v_{i}\rightarrow\infty$ the limit $2\sqrt{k-1}$ is the best we can get. Ramanujan graphs are the best expanders.

3 The family of graphs $D(n,q)$

The family of graphs we use in our construction of a MAC was introduced in 1992 by Lazebnik and Ustimenko, [15]. It is denoted by $D(n,q)$, $n\in\mathbb{N}_{\geq 2}$ and $q$ is a prime power. The similar notations that we use appeared later and can be found in [16]. To simplify, we don’t use double notations for coordinates of vectors. The family $D(n,q)$ is special because of a few important properties. The first one is that this is a family of graphs of a large girth, as mentioned in Sec. 2. Secondly, this is a family of very good expander graphs that are close to Ramanujan graphs. The idea of almost Ramanujan graphs was introduced in [28]. We refer to a family of $k$-regular graphs as almost Ramanujan graphs if $|\lambda_{1}(G_{i})|\leq 2\sqrt{k}$ for all $i$. Graphs $D(n,q)$, $n\geq 2$ for arbitrary $q$ form a family of $q$-regular almost Ramanujan graphs ($|\lambda_{1}(G_{i})|\leq 2\sqrt{q}$) and thus have excellent mixing properties.

Graphs $D(n,q)$ are bipartite with set of vertices $V$ containing two subsets: $V=P\cup L$, where $P\cap L=\emptyset$. Originally the subset of vertices $P$ is called a set of points and another set $L$ is called a set of lines. Let $P$ and $L$ be two copies of Cartesian power ${\mathbb{F}_{q}}^{n}$, where $n\geq 2$ is a integer. Two types of brackets are used in order to distinguish points from lines. We write $(\vec{z})$ if $\vec{z}\in P$ and $[\vec{z}]$ if $\vec{z}\in L$. The set of vertices of graph $D(n,q)$ (collection of points and lines) can be considered as $n$-dimensional vectors over $\mathbb{F}_{q}$:

[TABLE]

Coordinates of $(\vec{p})$ and $[\vec{l}]$ are elements of finite field $\mathbb{F}_{q}$. Because of this we have: $|P|=|L|=q^{n}$ and $|V|=2q^{n}$. The vertex $(\vec{p})$ (point $(\vec{p})$) is incident with the vertex $[\vec{l}]$ (line $[\vec{l}]$) and we write: $(\vec{p})I[\vec{l}]$, if the following relations between their coordinates hold:

[TABLE]

where $i\geq 5$. The set of edges $E$ consists of all pairs $((\vec{p}),[\vec{l}])$ for which $(\vec{p})I[\vec{l}]$. This is a family of $q$-regular graphs, which means that each vertex has exactly $q$ neighbors. $D(n,q)$ becomes disconnected for $n\geq 6$. Graphs $D(n,q)$ are edge transitive. It means that their connected components are isomorphic. A connected component of $D(n,q)$ is denoted by $CD(n,q)$. Notice that all connected components of infinite graph $D(q)$ are $q$-regular trees. The length of the shortest cycle (the girth) of a graph $D(n,q)$ is given by the formula:

[TABLE]

Graphs $D(n,q)$ were successfully used as a base for symmetric and public key multivariate cryptography (see for example: [32, 14, 24, 31, 30]), error correcting codes (see [9]) and pseudorandom number generator [36]. The related cryptosystems are very good candidates for post quantum cryptography and resistant to linearization attacks. The base of our message authentication code is a stream cipher algorithm where most of the constructions of message authentication functions are based on block ciphers.

4 Keyed hash function

Few notations are used in this work. Let $M$ denote the message, $N$ the number of bits per block of the $M$ and by $l(M)$ we represent the number of blocks. So the message can be expressed as $M=m\ldots m_{l(M)}$. We consider that the message is written in alphabet that corresponds to elements of finite field $\mathbb{F}_{q}$ and by $l(q)$ we denote the number of bits needed to represent number $q$ (for example UTF-8 uses number field $\mathbb{F}_{2^{8}}$). Calculations shall be performed in bigger number field than the number field ($\mathbb{F}_{q}$) that is used for the alphabet in order to achieve collection resistance property. Let denote by $\mathbb{F}_{Q}$ the number field used for calculations. The choice of $N$ determines $\mathbb{F}_{Q}$. Any change in message shall change the hash so different input blocks $m_{i}$ shall correspond to different edge colouring. To achieve it the following condition shall be satisfied

[TABLE]

It is convenient to choose $Q=p$, where $p$ is a prime number. In such case field arithmetic is simply modulo $p$ arithmetic.

From now on we denote by $h$ the size of output (tag). The input message $M$ is used as direction for walking around the graph $D(n,Q)$. We start with initial vertex $IV=\vec{v_{0}}$, which we consider to be a point ($(\vec{v_{0}})\in P$). The next visited vertex is obtained by the formula

[TABLE]

[TABLE]

where $\ast$ can be uniquely calculated from equations (1) (see Example 1). Recall that $D(n,q)$ graphs are bipartite: points cannot be incident to points and lines cannot be incident to lines.

Example 1**.**

Let consider graph $D(6,11)$ and $\vec{w}\in P$.

[TABLE]

Names are assigned for $\ast$: $[(1+3)^{2},\ast,\ast,\ast,\ast,\ast]=[5,l_{2},l_{3},l_{4},l_{5},l_{6}]$. Then

[TABLE]

where all operations are in finite field $\mathbb{F}_{11}$. The calculated neighbor of $(\vec{w})$ is $[5,2,6,9,5,9]$.

We propose two approaches to calculate the keyed hash function based on this family of graphs. We named the message authentication codes DMAC, because constructions are based on family of graphs $D(n,q)$. Keyed hash functions use a secret, which is used to calculate the hash. We propose a secret key to be a pair $(IV,S)$. $IV$ is an initial vector of length $n$ with coordinates from $\mathbb{F}_{q}$. $S$ is a password of $s$ characters from alphabet $\mathbb{F}_{q}$ such that

[TABLE]

In our constructions, after all blocks $m_{i}$ of a message are processed, we process a password $S$. The details are described in the next subsections.

4.1 Basic construction (DMAC-1)

Fig. 2 illustrates the first type of proposed DMAC’s.

Steps to authenticate the message with DMAC-1:

Agree secret key $K_{s}$, which is a pair $(IV,S)$. 2. 2.

split $M$ in blocks $m_{i}$ of length $N$ (add padding if needed) 3. 3.

Process the message. For $i=0,\ldots,l(M)-1$ do

• •

Characters of the block of message $m_{i}$ are concatenated to obtain a number $M_{i}$.

• •

Calculate the vertex $\vec{v_{i+1}}$ which is incident to vertex $\vec{v_{i}}$. So, we calculate the next visited vertex by using operator $N_{M_{i}}(v_{i})$:

[TABLE]

[TABLE]

where $\ast$ are calculated from equations (1). We start in vertex $\vec{v_{0}}$ that is equal to $IV$. 4. 4.

Process the password $S$. For a $i=l(M),\ldots,l(M)+r-1$ do

• •

Calculate the vertex $\vec{v_{i+1}}$ which is incident to vertex $\vec{v_{i}}$. So, we calculate the next visited vertex by using operator $N_{S_{i}}(\vec{v_{i}})$:

[TABLE]

[TABLE]

where $\ast$ are calculated from equations (1). We start in vertex $\vec{v}_{l(M)}$ (the last visited vertex in step 3).

4.2 Modified construction (DMAC-2)

For $n\geq 6$ graphs become disconnected. In order to move from one component to another we can use simple modifications presented in Fig. 3. A vectors addition + over $\mathbb{F}_{Q}$ is added.

In this case steps to authenticate the message with message authentication code are the same like for DMAC-1 except one additional step. Steps to authenticate the message with DMAC-2:

Agree secret key $K_{s}$, which is a pair $(IV,S)$. 2. 2.

split $M$ in blocks $m_{i}$ of length $N$ (add padding if needed) 3. 3.

Process the message. For $i=0,\ldots,l(M)-1$ do

• •

Characters of the block of message $m_{i}$ are concatenated to obtain the number $M_{i}$.

• •

Calculate the vertex $\vec{v_{i+1}}$ which is incident to vertex $\vec{v_{i}}$. So, we calculate the next visited vertex by using operator $N_{M_{i}}(\vec{v_{i}})$. We start in vertex $\vec{v_{0}}$ that is equal to $IV$.

• •

Add vectors $\vec{v_{i}}$ and $\vec{v_{i+1}}$ over $\mathbb{F}_{Q}$. 4. 4.

Process the password $S$. For a $i=l(M),\ldots,l(M)+r-1$ do

• •

Calculate the vertex $\vec{v_{i+1}}$ which is incident to vertex $\vec{v_{i}}$. So, we calculate the next visited vertex by using operator $N_{S_{i}}(\vec{v_{i}})$. We start in vertex $\vec{v}_{l(M)}$ (the last visited vertex in step 3).

• •

Add vectors $\vec{v_{i}}$ and $\vec{v_{i+1}}$ over $\mathbb{F}_{Q}$.

Example 2**.**

(A toy example) Let’s consider the following example. The alphabet is $\mathbb{F}_{29}$. We want to calculate DMAC-2 of 15 bits ($h=15$) for a message $M$ and a secret key $K_{s}$.

[TABLE]

$M:$A–BEAUTIFUL–DAY corresponds to the vector $(0,28,1,4,0,...,24)$

$S:$.AY corresponds to the vector $(26,0,24)$

$IV=(5,10,27)=\vec{v_{0}}$

In this case $l(q)=5$ bits. We shall use $n$ that satisfies: $h\leqslant n\cdot l(q)$. Hence $n=3$. If we set $N=25$ bits then each block has 5 characters and we decide to use $Q=33554467$. We use graph $D(3,33554467)$. We have 3 blocks ($l(M)=3$) total and the last block is padded:

[TABLE]

[TABLE]

[TABLE]

$i=0$

[TABLE]

because

[TABLE]

[TABLE] 2. 2.

$i=1$

[TABLE]

because

[TABLE]

[TABLE] 3. 3.

$i=2$

[TABLE]

because

[TABLE]

[TABLE] 4. 4.

$i=3$ $\dots$ 5. 5.

$i=4$ $\dots$ 6. 6.

$i=5$ $\dots$

[TABLE]

4.3 Properties of DMACs

A cryptographic hash function must work as follows: a small change in the input drastically changes the output. This is called avalanche effect. DMAC-1 and DMAC-2 were implemented and tested in Python. Our DMACs are the case of a high-quality keyed hash functions (see Table 2). Results presented in table are for the following parameters: graph $D(32,257)$, $N=32$, $h=256$. Output of the presented keyed hash functions passed the well known Diehard tests, developed by George Marsaglia, for measuring the quality of random number generators, [21].

As defined above $h$ is the number of bits of the output (tag). Popular size of tags are $h=128$ bits, $h=256$ bits, $h=512$ bits and $h=1024$ bits. When for most of commonly used algorithms the size of tag is fixed (for example: SHA-3-224 and SHA-3-256), in our approach the tag can have arbitrary length. The size of block length $N$ can be chosen quite arbitrarily but it has to be much smaller than the size of the message $M$ and $N\geq l(q)$. The longer the size of block, the more efficient the algorithm. Notice that if $l(q)=N$ then message is encoded character by character and it becomes a kind of ’string’ algorithm.

The parameters of graph $D(n,Q)$ that is used depend on the block size $N$ and the size of tag $h$. The paramater $Q$ is chosen to satisfy the property the inequality $Q\geq 2^{N}$ and the parameter $n$ is chosen as the smallest possible $n$ that satisfies the inequality

[TABLE]

The most commonly used encodings are UTF-8 ($l(q)=8$), UTF-16 ($l(q)=16$), UTF-32 ($l(q)=32$). The Table 1 presents example values of $n$ when $h$ and alphabet $\mathbb{F}_{q}$ ($l(q)$) are fixed.

Example 3**.**

Let’s consider a message $M$ of 2000 characters writen in UTF-8 (alphabet $\mathbb{F}_{2^{8}}$; $l(q)=8$) parameter $S$ of 10 characters . We want to divide the message on blocks of 4 characters ($N=32$ bits) and compute a tag of length $h=512$ bits for this message.

Parameter $n$ can be computed from the formula $h\leq n\cdot l(q)$:

[TABLE]

Then we choose a prime power $Q$ such that

[TABLE]

Thus we use $D(64,2^{32})$ graph. The length of the shortest cycle in this graph is $g(D(64,2^{32}))=68$ and the order of the graph is $2\cdot(2^{32})^{64}=2^{2048}$.

5 Collision resistance and one way property

Recall that, the family of graphs is a family of graphs of large girth and $g(D(n,q))=2[(n+5)/2]$. Hence there are no cycles shorter than $2[(n+5)/2]$ and therefore for numer of blocks smaller than $[(n+5)/2]$ no collisions can be find. First, we consider the following problems.

Problem 1**.**

Find a cycle in graph $D(n,Q)$ that passes through vertex $v_{0}$ and $v_{l(M)}$.

Problem 2**.**

Find a path between vertex $v_{0}$ and $h$ in graph $D(n,Q)$, that contains a subpath defined by $S$ that ends in $h$.

First of all we shall notice that the secret key is a pair $(IV=v_{0},S)$. For an adversary that doesn’t know the secret key those problems are not defined precisely. The problem of collision resistance is essentially the problem of finding a shortest cycle in the graph $D(n,q)$ (similarly as it was considered in [6] for other graphs). We have the following theorem.

Theorem 1**.**

Finding a collision in DMACs is a solution to Problem 1.

Proof.

If we set $v_{0}$ to be zero vector then DMAC-1 and DMAC-2 are exactly the same functions. Finding a collision in DMAC-2 cannot be easier than finding a collision in DMAC-1. Therefore, without lost of generalisation we can consider collision resistance of DMAC-1.

To compute a hash DMAC-1 we start a walk in vertex $v_{0}$ and an input $M=m_{1}m_{2}\dots m_{l(M)}$ (message $M$) gives us directions $M_{i}$ how to walk in this graph. Each vertex is $Q$-regular and $M_{i}\leq Q$ so different blocks correspond to different edges incydet to a given vertex. To find a collision we have to find two different inputs $M\neq M^{\prime}$, which hash to the same output $h$. To calculate output $h$ first we have to calculate vertex $v_{l(M)}$ and then using secret $S$ we can walk to vertex that corresponds to $h$. If $v_{l(M)}\neq v_{l(M^{\prime})}$ then $S$ such that: $s<\frac{1}{2}g(D(n,Q))$ would lead us to different $h$ and $h^{\prime}$ ($g(D(n,Q)$ denotes the length of the shortest cycle in graph). Hence, to find a collision we have to find two different inputs $M\neq M^{\prime}$, which leads us to one vertex $v_{l(M)}=v_{l(M^{\prime})}$. Two paths in graph, that start and end in the same vertices form a cycle. ∎

Graphs $D(n,q)$ form a family of a simple graphs. In this case $O(|V|)$ time is required to find a cycle in an $|V|$-vertex graph, that starts in a given vertex. However here $|V|=2Q^{n}$ so the complexity becomes exponential. Then $O(|V|)$ is a time required requaired to find any cycle. In our case we are looking for a specific cycle that contains also $v_{l(M)}$.

The family of graphs is a family of graphs of large girth and $g(D(n,q))=2[(n+5)/2]$. Therefore, the problem of finding a shortest cycle in $D(n,q)$ graphs cannot be easier than the general problem of finding the shortest path in a regular graph, which is considered to be hard.

Theorem 2**.**

Finding a preimage of $h$ is a solution to Problem 2.

Proof.

Because of the reason given in the proof of Theorem 1, without lost of generalisation we can consider preimage resistance of DMAC-1. If we have knowledge about $S$ then vertex $v_{l(M)}$ can be computed. An input $M=m_{1}m_{2}\dots m_{l(M)}$ message gives us directions $M_{i}$ how to walk in this graph. We start a walk in initial vertex $IV=\vec{v_{0}}$. The second visited vertex is defined by the operator $N_{M_{1}}(\vec{v_{0}})$ and uniquely determined from equations (1). The next visited vertex is defined by the operator $N_{M_{2}}(\vec{v_{0}})$ and uniquely determined from equations (1). We repeat the calculations until we deal with all blocks $m_{i}$. Graph $D(n,Q)$ is $Q$-regular and $M_{i}\leqslant Q$ so different $M_{i}$ gives us different directions. Each $M_{i}$ corresponds exactly to one edge incidence to a given vertex. There are many different paths from $v_{0}$ to $v_{l(M)}$. Find the preimage is to find the right path from $v_{0}$ to $v_{l(M)}$. Notice that $v_{0}$ is a part of a secret key. ∎

Composition of operators $N_{M_{i}}$ and $N_{S_{i}}$ gives a nonlinear system of $n-1$ cubic eqations (see Theorem 2 in [34]). Variables are: numbers $M_{i}$, $s$ character of $S$ and $n$ coordinates of initial vertex $v_{0}$. There is $l(M)+n+s$ total variables in this system.

In general, solving a set of quadratic equations over a finite field is NP-hard ($MQ$ problem) for any finite field. There is a conjecture that this is a probabilistically hard problem and Shor’s algorithm cannot be used to speed it up, [10]. Solving a set of cubic equations over a finite field cannot be easier than solving the $MQ$ problem. However, the system related to the set of equations 1 and other systems used for multivariate cryptography are not random, for a large enough parameters it is computationally infeasible to solve them (see [10]).

Brute force attack to completely break the keyed hash function (find secret $K_{s}$) may require to check $q^{n}q^{r}$ possibilities ($q^{n}$ possible initial vectors and $q^{r}$ possible passwords of length $r$), if we consider that the length of the $S$ is known. A very efficient algorithm to find the shortest path in a graph is Dijkstra’s algorithm of complexity $O(|V|\log|V|+|E|)$ and it can be adopted to find collisions. In the case of the used graphs it gives $O(2Q^{n}\log(2Q^{n})+Q^{n+1})$ and it’s not more efficient than brute force. The complexity is increased because calculations are made over bigger number field $\mathbb{F}_{Q}$, without changing the alphabet for $IV$ and $S$.

6 Timings

The number of operations per bit of input depend on block length $N$ and on the parameter $n$ of the graph $D(n,Q)$. The number of field operations in the system of equations 1 is $2(n-1)$ (one step of the walk in the graph $D(n,Q)$ costs $2(n-1)$ field operations).

To process one block of input with DMAC-1 we need two additions and one multiplication as specified by operator $N_{t}(w)$ (to calculate the first coordinate of the neighbor), \mod operation and $2(n-1)$ field operations. After the block is processed we process vector $S$. Therefore, the number of operations per bit of input for DMAC-1 is given by the formula

[TABLE]

where $r$ is the length of $S$ and $l(M)$ is the number of blocks, as specified above.

To process one block of input with DMAC-2 we need to add vectors over number field $\mathbb{F}_{q}$ which require $n$ field additions. It gives us the following formula for the number of operations per bit of input when DMAC-2 is used

[TABLE]

If the password $S$ is short (not more than 10 characters) and the message, for which we want to calculate the tag, is long (which is true in general when MACs are used) then $\frac{r}{l(M)}$ is very small. Notice that the change of number field doesn’t increase much the number of operations per bit of input (except for the fact that resulting vector has to be divided $\mod q$).

Example 4**.**

Lets consider data like in Example 3. The length of $M$ in bits is $2000\cdot l(q)=2000\cdot 8$. The block length is $N=32$ bits so the number of blocks $l(M)=\dfrac{2000\cdot 8}{32}=500$. In this case the number of field operations per bit of input is

[TABLE]

which is very efficient.

7 Conclusions

A new technique for message authentication was presented in this work. To the best of our knowledge, the family of graphs $D(n,q)$ has never been used before in this context. The algorithms here introduced, for DMAC-1 and DMAC-2 respectively, were implemented in Python and tested with different inputs. The results of our tests and the theoretical base show that the technique we introduce is a very efficient and safe approach to compute message authentication code.

Acknowledgement

The authors would like to express their gratitude to Vasyl Ustimenko for sharing his knowledge about graphs $D(n,q)$, which made this research possible. Special thanks also to Stanislaw Radziszowski for his useful remarks.