Domain Extension for MACs Beyond the Birthday Barrier


Given an n-bit to n-bit MAC (e.g., a fixed key blockcipher) with MAC security ε against q queries, we design a variable-length MAC achieving MAC security O(εq,poly(n)) against queries of total length qn. In particular, our construction is the first to break the “birthday barrier” for MAC domain extension from noncompressing primitives, since our security bound is meaningful even for q = 2 n /poly(n) (assuming ε is the best possible O(1/2 n )). In contrast, the previous best construction for MAC domain extension for n-bit to n-bit primitives, due to Dodis and Steinberger [11], achieved MAC security of O(εq 2 (log q)2), which means that q cannot cross the “birthday bound” of 2 n/2.