Distinguishing and Forgery Attacks on Alred and Its AES-based Instance Alpha-MAC

In this paper, we present new distinguishers of the MAC construction Alred and its specific instance Alpha-MAC based on AES, which is proposed by Daemen and Rijmen in 2005. For the Alred construction, we describe a general distinguishing attack which leads to a forgery attack directly. The complexity is 2 chosen messages and 2 queries with success probability 0.63. We also use a two-round collision differential path for Alpha-MAC, to construct a new distinguisher with about 2 queries. The most important is that the new distinguisher can be used to recover the internal state, which is an equivalent secret subkey, and leads to a second preimage attack. Moreover, the distinguisher on Alred construction is also applicable to the MACs based on CBC and CFB encryption mode.