A Forgery Attack against PANDA-s

PANDA is an authenticated encryption scheme designed by Ye et al., and submitted to the CAESAR competition. The designers claim that PANDA-s, which is one of the designs of the PANDA-family, provides 128-bit security in the nonce misuse model. In this note, we describe our forgery attack against PANDA-s. Our attack works in the nonce misuse model. It exploits the fact that the message processing function and the finalization function are identical, and thus a variant of the lengthextension attack can be applied. We can find a tag for a pre-specified formatted message with 2 encryption oracle calls, 2 computational cost, and negligible memory.