What block cipher is used for CBC-MAC? DES, AES, 3DES? Or it doesn't matter?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Well, yes, it does matter; however the terminology 'CBC-MAC' does not specify which.
CBC-MAC is a generic construction that takes an arbitrary block cipher, and turns it into an object that acts like a MAC for fixed length messages (much like CBC mode is a generic construction that takes an arbitrary block cipher, and turns it into a object that encrypts variable length messages). And, just like "CBC" isn't necessarily used with a specific block cipher, neither is CBC-MAC.
Note: CBC-MAC has issues if you try to use it with variable length messages; CMAC and XCBC are two modes similar to CBC-MAC that avoid this problem.
CBC-MAC is a MAC construction based on a block cipher. Any block cipher will do, but the security of the scheme is reducible to the security of the block cipher. To put it more precisely, any block cipher will make a secure CBC-MAC as long as that block cipher is a secure pseudorandom permutation.
First the block cipher can take on more than one general form provided certain criteria are met and in terms of: block cipher, Fk, secure CBC-MAC,and of course CBC mode. Pseudo random generators and permutations as an aside an in response to above are very related in terms of inversion. In symbols F:K*X---> PRP. If a given block cipher is secure this does not make the MAC secured, vice verse a secure CBC-MAC/CBC-MODE does NOT make a secure block cipher. In MAC engineering and cryptology in general there are many paths to exploitation. While Wikipedia and other sites get PRP and PRG somewhat correct and hint at or briefly mention prepending they do a poor job at actually explaining the finer points that matter in this discussion. As long as the block cipher meets certain minimum requirements then it is suitable for the CBC-MAC.
CBC-MAC Handles arbitrary length messages and more specifically message much longer than a single block Length. The message can be of arbitrary but fixed length. Both sender and receiver must agree on the length of the message beforehand in theory, but this is not realistic in practice so messages can be changed in length via a few methods, but one practical one is prep-ending the length of the message where: to authenticate a message m1--ml where l can take on any value l will be coded as a single block using n bits perhaps padding to the left with 0's then run the CBC-MAC system m1--ml messages and will handle any arbitrary message of any length l.
Given a message m1--ml where each Mi represents a block of the message whose length is = to the block length of SOME underlying block cipher we can compute a tag by applying the block cipher Fk (effs of k) to the initial block M1 value then use it as a chaining value and xor to M2 and all through the same until a result: a tag t of the message m1--to ml.CB-MAC is also deterministic unlike CBC mode which itself has IV = initiation vector which would make if used CBC-MAC insecure.However,both CBC and mode are necessary to be secure. Finally, the element t must be mapped to set x by a separate key k in the Key space.Without this final encryption function, this function is known as a cascade function and it is not secure. Yet the fpad at the end matches mode functions to protect the Block cipher.
Interestingly hash functions are related to CBC-MAC/CBC MODE and they are an engineered response to some MAC issues.
Dan Boneh Cryptography I Coursera/Stanford.
Jonathan Katz Cryptography Coursera/University of Maryland