Advances in Cryptology – EUROCRYPT 2011

Volume 6632 of the series Lecture Notes in Computer Science pp 323-342

Domain Extension for MACs Beyond the Birthday Barrier

  • Yevgeniy DodisAffiliated withDepartment of Computer Science, New York University
  • , John SteinbergerAffiliated withInstitute for Theoretical Computer Science, Tsinghua University


Given an n-bit to n-bit MAC (e.g., a fixed key blockcipher) with MAC security ε against q queries, we design a variable-length MAC achieving MAC security O(εq,poly(n)) against queries of total length qn. In particular, our construction is the first to break the “birthday barrier” for MAC domain extension from noncompressing primitives, since our security bound is meaningful even for q = 2 n /poly(n) (assuming ε is the best possible O(1/2 n )). In contrast, the previous best construction for MAC domain extension for n-bit to n-bit primitives, due to Dodis and Steinberger [11], achieved MAC security of O(εq 2 (log q)2), which means that q cannot cross the “birthday bound” of 2 n/2.