# How many blocks can we change if know MAC and key

I stumbled across a question while studying about MAC,

I was thinking if the attacker knows the key and the MAC and he wants to change the message to send to the victim, then how many blocks can he change with whatever he wants?

I think that he is unable to change the last plaintext block as the MAC will depend on it and to ensure that he has to generate a fixed cipher text for second last plaintext block so that he can force the last plain text to be exactly what he needs. So I guess he can modify all blocks freely except the last two.

The second option which I was thinking is that as the attacker can modify the plaintext, what if leaves the plaintext of the last block exactly same?

I believe that though MAC depends on all blocks, but as its value is only decided by the final plain text, we can keep the final plain text as the original message.

Which interpretation is correct? Or am I completely wrong?

-
What kind of MAC? $\;$ –  Ricky Demer Sep 19 '13 at 2:09
any kind of MAC in general –  user2782324 Sep 19 '13 at 3:21
It's impossible to answer this question without a particular instanciation of a MAC algorithm. For example CBC-MAC is completely broken if the adversary has the key whereas HMAC and adversary with the key still has a lot of work to do –  Alexandre Yamajako Sep 19 '13 at 13:05
I found out the answer that it's possible to change all the blocks except the last two in worst case scenario. The last text needs to be the same so that the max will be same. Whereas the second last block has to fixed to force the last block to be the required value. –  user2782324 Sep 20 '13 at 0:34
Alexandre Yamajako: Good comment, but I would say instead that it is possible to answer this question. MAC (Message Authentication Code) does not give such guarantees. The fact that HMAC provides such guarantee (when it is not truncated a lot) is just added benefit of HMAC. –  user4982 Sep 22 '13 at 19:25