Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found this question about CBC-MAC forging and want to make sure I understand it:

Let a and be be two strings of block length one. Suppose the sender sends $(a, \text{CBC-MAC}(a)), (b, \text{CBC-MAC}(b)), (a||b, \text{CBC-MAC}(a||b))$. Find new messages / MAC pair which the attack can now forge from the messages / MACs given above.

I have: $\text{CBC-MAC}(x) = t$ and $\text{CBC-MAC}(y) = t'$,
then $\text{CBC-MAC}(x || y \oplus t) = t'$.
Then can I forge the permutation combination of the given pairs with that formula? i.e. if $\text{CBC-MAC}(a) = x$ and $\text{CBC-MAC}(b) = y$, then $\text{CBC-MAC}(a || b \oplus x) = y$.

share|improve this question
CBC-MAC(x || y $\oplus$ t) = t' is to be read as CBC-MAC(x ||(y $\oplus$ t)) = t' with t right-padded with enough zeros to match the length of y . – fgrieu Nov 6 '13 at 14:11
which textbook is this from? I can't find this is any Cryptography textbook – user9293 Nov 7 '13 at 21:10
up vote 3 down vote accepted

Yes, your understanding is correct. With the CBC-MAC's of $(a), (b)$ and $(a||b)$ you can forge the following new messages:

$(a||b \oplus MAC(a)), \\ (b||a \oplus MAC(b)), \\ (b||b \oplus MAC(b)),\\ (a||a \oplus MAC(a)),\\ (a||b||a \oplus MAC(a||b)), \\ (a||b||b \oplus MAC(a||b)), \\ (a||b \oplus MAC(a)||a \oplus MAC(b))\\ (a||b \oplus MAC(a)||b \oplus MAC(b))\\$

...And so on and so forth until you get tired of pwning CBC-MAC with forgeries (assuming the recipient accepts messages longer than the one-to-two blocks we know from the question).

share|improve this answer

protected by Community Nov 9 '13 at 2:46

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.