Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

What block cipher is used for CBC-MAC? DES, AES, 3DES? Or it doesn't matter?

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

Well, yes, it does matter; however the terminology 'CBC-MAC' does not specify which.

CBC-MAC is a generic construction that takes an arbitrary block cipher, and turns it into an object that acts like a MAC for fixed length messages (much like CBC mode is a generic construction that takes an arbitrary block cipher, and turns it into a object that encrypts variable length messages). And, just like "CBC" isn't necessarily used with a specific block cipher, neither is CBC-MAC.

Note: CBC-MAC has issues if you try to use it with variable length messages; CMAC and XCBC are two modes similar to CBC-MAC that avoid this problem.

share|improve this answer
1  
I prefer to say that CBC-MAC is a construction that constructs a MAC from an arbitrary block cipher. If the block cipher is secure and we restrict to fixed-length messages, the MAC is also secure. For variable-length messages, the MAC is insecure regardless of block cipher. –  K.G. Oct 22 '13 at 11:48
add comment

CBC-MAC is a MAC construction based on a block cipher. Any block cipher will do, but the security of the scheme is reducible to the security of the block cipher. To put it more precisely, any block cipher will make a secure CBC-MAC as long as that block cipher is a secure pseudorandom permutation.

share|improve this answer
    
Actually, the security of CBC-MAC as a MAC is not reducible to the security of the block cipher. For example, if we ignore padding, and $A$ and $B$ are messages with lengths a multiple of the block size, then if $CBCMAC(A) = X$ and $CBCMAC(A|X) = Y$ and $CBCMAC(B) = Z$, then we can deduce that $CBCMAC(B|Z) = Y$; this is a violation of the MAC properties. Including padding complicates this attack, but not enough to make it infeasible. –  poncho Oct 21 '13 at 20:11
1  
Yeah but this violates the definition of CBC-MAC, namely that it acts on messages of fixed length. –  pg1989 Oct 21 '13 at 21:43
    
CBC-MAC is fine with variable length messages, as long as you never have one message that's a prefix of another. For example a length prefix can achieve that if you know the length of the message beforehand. –  CodesInChaos Oct 22 '13 at 16:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.