# Why is it insecure to use a randomized IV for CBC-MAC instead of an all-zero IV?

A fixed length CBC-MAC uses an all-zero block as the initialization vector.

Suppose that we used a randomized IV instead, and sent the IV along with the tag. So if the message $m$ will be $m = b_1 || b_2 || b_3 || ... || b_l$, the MAC will be $(IV, t)$ where $t$ is the authentication tag defined as normal.

Why is this method of using a randomized IV more insecure than the normal method of using an all zero IV?

(This method was used in some nCipher products, and declared insecure in nCipher Advisory #13 – see also nCipher Insecure CBC-MAC API Vulnerability.)

-

## migrated from stackoverflow.comOct 27 '11 at 0:40

This question came from our site for professional and enthusiast programmers.

Welcome to Cryptography Stack Exchange. Your question was migrated here because of being not directly related to software development (the topic of Stack Overflow), and being fully on-topic here. Please register your account here, too, to be able to comment (if necessary). – Paŭlo Ebermann Oct 27 '11 at 12:24

The link to nCipher Advisory #13  shows a diagram in the section "Cryptographic details" that is distorted. Could you provide a better one? Thanks. – Ursa Major May 24 at 5:13