Improved security analysis of PMAC

In this paper we provide a simple, concrete and improved security analysis of Parallelizable Message Authentication Code or PMAC. In particular, we show that the advantage of any distinguisher A at distinguishing PMAC from a random function is at most (5qσ − 3.5q)/2. Here, σ is the total number of message blocks in all q queries made by A and PMAC is based on a random permutation over {0, 1}. In the original paper of PMAC by Black and Rogaway in Eurocrypt-2002, the bound was shown to be (σ + 1)2/2n−1. In FSE-2007, Minematsu and Matsushima provided a bound 5`q/(2 − 2`), where ` is the number of blocks of the longest queried made by the distinguisher. Our proposed bound is sharper than these two previous bounds.