# What block cipher is used for CBC-MAC?

What block cipher is used for CBC-MAC? DES, AES, 3DES? Or it doesn't matter?

-

Well, yes, it does matter; however the terminology 'CBC-MAC' does not specify which.

CBC-MAC is a generic construction that takes an arbitrary block cipher, and turns it into an object that acts like a MAC for fixed length messages (much like CBC mode is a generic construction that takes an arbitrary block cipher, and turns it into a object that encrypts variable length messages). And, just like "CBC" isn't necessarily used with a specific block cipher, neither is CBC-MAC.

Note: CBC-MAC has issues if you try to use it with variable length messages; CMAC and XCBC are two modes similar to CBC-MAC that avoid this problem.

-
I prefer to say that CBC-MAC is a construction that constructs a MAC from an arbitrary block cipher. If the block cipher is secure and we restrict to fixed-length messages, the MAC is also secure. For variable-length messages, the MAC is insecure regardless of block cipher. –  K.G. Oct 22 '13 at 11:48
Actually, the security of CBC-MAC as a MAC is not reducible to the security of the block cipher. For example, if we ignore padding, and $A$ and $B$ are messages with lengths a multiple of the block size, then if $CBCMAC(A) = X$ and $CBCMAC(A|X) = Y$ and $CBCMAC(B) = Z$, then we can deduce that $CBCMAC(B|Z) = Y$; this is a violation of the MAC properties. Including padding complicates this attack, but not enough to make it infeasible. –  poncho Oct 21 '13 at 20:11