An analysis of the 3gpp-MAC scheme

Key recovery attacks are described on the 3gpp-MAC scheme, proposed for inclusion in the 3gpp specification. Three main attacks are given, all of which operate whether or not truncation is applied to the MAC value. The first type of attack uses a large number of ‘chosen MACs’, the second type of attack a large number of ‘known MACs’, whereas the third attack requires a large number of MAC verifications, but very few known MACs and no chosen MACs.