Why not just apply hash function on the whole message? Why convert that message into blocks and hash those blocks? To avoid collisions?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
A hash function is not a MAC, although you can turn it into a MAC (see e.g. HMAC).
The purpose of a MAC is message authenticity / integrity -- to prevent attackers (i.e. people who don't know the secret key) from modifying the message or forging fake messages. A hash function trivially cannot fulfill the function of a MAC, because hash functions are unkeyed -- thus an attacker can always forge fake messages because they can calculate the digest of any message as easily as the legitimate parties.
With a MAC, such as CBC-MAC or HMAC, only the people who know the secret key can easily calculate the authentication 'Tag' for a given message, so if a message is sent accompanied by the correct Tag for that message then the receiver knows the message was almost certainly sent by someone who knew the key, and has not been altered (i.e. changed to a different message) in transit.
Hash (message digest) and MAC (message authentication code) are a different thing.
CBC-MAC turns block cipher into MAC. HMAC turns hash function into MAC.
A good reason to use CBC-MAC would be that a MAC is needed and there is a suitable implementation of sufficiently secure block cipher available.
For instance, many of recent Intel-based processors have AES implemented in instruction set. Such hardware implementation is very fast, yet relatively secure.
CBC-MAC is mainly for fixed length messages
(Important note on using CBC-MAC.)
CBC-MAC is secure for fixed-length messages (or other prefix free messages). This is restriction which is occasionally overlooked by implementors and may result in significant security hole(s). There exists a newer cipher-based MAC, known as CMAC, which does not have this restriction. CMAC is introduced in NIST Special Publication 800-38B.