ZMAC+ – An Efficient Variable-output-length Variant of ZMAC

Abstract

There is an ongoing trend in the symmetric-key cryptographic community to construct highly secure modes and message authentication codes based on tweakable block ciphers (TBCs). Recent constructions, such as Cogliati et al.’s HaT or Iwata et al.’s ZMAC, employ both the n-bit plaintext and the t-bit tweak simultaneously for higher performance.
This work revisits ZMAC, and proposes a simpler alternative finalization based on HaT. As a result, we propose HtTBC, and call its instantiation with ZHash as a hash function ZMAC⁺. Compared to HaT, ZMAC⁺ (1) requires only a single key and a single primitive. Compared to ZMAC, our construction (2) allows variable, per-query parametrizable output lengths. Moreover, ZMAC⁺ (3) avoids the complex finalization of ZMAC and (4) improves the security bound from Ο(σ²/2^n+min(n,t)) to Ο(q/2ⁿ + q(q + σ)/2^n+min(n,t)) while retaining a practical tweak space.