Further More on Key Wrapping

At SAC 2009, Gennaro and Halevi showed that a key wrapping scheme using a universal hash function and ECB mode (a HtECB scheme) is broken, and the security of a scheme based on a universal hash function and CBC mode (a HtCBC scheme) has been left as an open problem. In this paper, we first generalize classical notions of universal and uniform hash functions, and propose two new notions, where we consider the composition of the keyed hash function. We then prove that the HtECB scheme is a secure key wrapping scheme if a universal hash function satisfies uniformity and our notions. We further generalize the notions, and propose two more new notions for a keyed hash function. We present a partial answer to the open problem by showing that the HtCBC scheme using a universal hash function that also satisfies uniformity and the new notions is a secure key wrapping scheme. We then point out that a monic polynomial hash function satisfies all the new notions. Therefore, by combining the monic polynomial hash function with ECB mode and CBC mode, we obtain secure and efficient key wrapping schemes.