Revisiting ZMAC+: Birthday-Bound Attacks and a Beyond-Birthday-Bound Repair

What it is

"Revisiting ZMAC+" is an ePrint paper (2026/2647, received 26 October 2026) by Yan Jia, Peng Wang, Lei Hu, Shuping Mao, Tingting Guo and Jiadong Han. It attacks ZMAC+, the tweakable-block-cipher MAC from List and Nandi (ToSC 2017), and proposes a repaired variant. The paper is a preprint, not peer reviewed.

How it works

The attack reuses a tag-swap mechanism previously observed for a hypothetical two-output extension of DoveMAC. An internal collision between two message families exchanges their tag blocks. A common extension of both messages preserves this relation, so one additional authentication query turns the swap into a forgery on a fresh message. Both results are in the ideal-TBC model, with n the block length.

The distinguisher works for every legal fixed output length d ≥ 2. The forgery works for every legal even d. The paper also finds a counting error in the published Lemma 4 and proves a corrected aggregate differential bound. That bound gives PRF and MAC upper bounds that match the birthday threshold for bounded message lengths and two-block tags, under explicit field-order conditions.

Preconditions / Affected

• The attack applies to the published ZMAC+ construction with multi-block tags, including two-block tags.
• Odd d is not covered by the forgery, only by the distinguisher.
• The repair keeps ZHash and separates the output domains. Its adaptive PRF bound of order q²/2^(n+min(n,t)) holds only under stated field-order, length and domain-capacity conditions, and for bounded message lengths.

What to do

The page gives no commands or patches. An engineer using ZMAC+ with tags longer than one block should treat its beyond-birthday-bound claim as refuted for those tag lengths. The paper's repaired variant is the stated alternative, and its conditions need checking against the intended parameters.

Caveats

• The abstract says a one-query counterexample shows that the ZAE security theorem must keep the per-message length restriction required by its counter-in-tweak encryption component. Anyone relying on ZAE should check that restriction.
• The fetched text is the abstract only. Concrete constants, the field-order conditions and the repair's full specification are not visible there.