# What block cipher is used for CBC-MAC?

What block cipher is used for CBC-MAC? DES, AES, 3DES? Or it doesn't matter?

-

Well, yes, it does matter; however the terminology 'CBC-MAC' does not specify which.

CBC-MAC is a generic construction that takes an arbitrary block cipher, and turns it into an object that acts like a MAC for fixed length messages (much like CBC mode is a generic construction that takes an arbitrary block cipher, and turns it into a object that encrypts variable length messages). And, just like "CBC" isn't necessarily used with a specific block cipher, neither is CBC-MAC.

Note: CBC-MAC has issues if you try to use it with variable length messages; CMAC and XCBC are two modes similar to CBC-MAC that avoid this problem.

-
I prefer to say that CBC-MAC is a construction that constructs a MAC from an arbitrary block cipher. If the block cipher is secure and we restrict to fixed-length messages, the MAC is also secure. For variable-length messages, the MAC is insecure regardless of block cipher. –  K.G. Oct 22 '13 at 11:48

CBC-MAC is a MAC construction based on a block cipher. Any block cipher will do, but the security of the scheme is reducible to the security of the block cipher. To put it more precisely, any block cipher will make a secure CBC-MAC as long as that block cipher is a secure pseudorandom permutation.

-
Actually, the security of CBC-MAC as a MAC is not reducible to the security of the block cipher. For example, if we ignore padding, and $A$ and $B$ are messages with lengths a multiple of the block size, then if $CBCMAC(A) = X$ and $CBCMAC(A|X) = Y$ and $CBCMAC(B) = Z$, then we can deduce that $CBCMAC(B|Z) = Y$; this is a violation of the MAC properties. Including padding complicates this attack, but not enough to make it infeasible. –  poncho Oct 21 '13 at 20:11
Yeah but this violates the definition of CBC-MAC, namely that it acts on messages of fixed length. –  pg1989 Oct 21 '13 at 21:43
CBC-MAC is fine with variable length messages, as long as you never have one message that's a prefix of another. For example a length prefix can achieve that if you know the length of the message beforehand. –  CodesInChaos Oct 22 '13 at 16:39