On the Security of HB# against a Man-in-the-Middle Attack

At EuroCrypt ’08, Gilbert, Robshaw and Seurin proposed HB to improve on HB in terms of transmission cost and security against man-in-the-middle attacks. Although the security of HB is formally proven against a certain class of man-in-the-middle adversaries, it is only conjectured for the general case. In this paper, we present a general man-in-the-middle attack against HB and Random-HB, which can also be applied to all anterior HB-like protocols, that recovers the shared secret in 2 or 2 authentication rounds for HB and 2 or 2 for Random-HB, depending on the parameter set. We further show that the asymptotic complexity of our attack is polynomial under some conditions on the parameter set which are met on one of those proposed in [8].