Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I'm trying to implement AES CBC MAC splicing attack in Python, the idea is:

given a message M, its tag Tm (MAC(M) = T), a new message N and its tag Tn we build a message such as: M||N = (M1, ..., Mn, N1 ⊕ Tn, N2, ..., Nn) that has the same tag with N (that is because you inserted a block which resets the algorithm).

The idea is quite clear, but I still cannot get the correct tag.

Here is my code (I'm new to Python, sorry):

from Crypto.Cipher import AES
from Crypto.Util.strxor import strxor
from binascii import hexlify
import argparse
import pickle

BLOCK_SIZE = AES.block_size

def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("f1", type=str, help="f1")
    parser.add_argument("f2", type=str, help="f2")
    parser.add_argument("tag1", type=str, help="tag1")
    parser.add_argument("tag2", type=str, help="tag2")
    parser.add_argument("k", type=str, help="key")
    args = parser.parse_args()
    with open(args.tag2, "rb") as tag2:
        stored_tag = pickle.load(tag2)
    with open(args.k, mode="rb") as f:
        key = pickle.load(f)
    assert len(key) == AES_KEY_SIZE
    cipher = AES.new(key, AES.MODE_CBC, b'\0' * BLOCK_SIZE)
    with open(args.f2, mode="rb") as f2:
        f2_block1 = f2.read(BLOCK_SIZE)
        b1 = cipher.encrypt(strxor(f2_block1, stored_tag))
        with open(args.f1, mode="rb") as f1:
            file1 = f1.read()
        file2 = f2.read()
        the_rest_of_the_file = file2[BLOCK_SIZE:len(file2)]
        new = open('newfile.file','w')
        s = file1 + b1 + the_rest_of_the_file

if __name__=="__main__":
share|improve this question
I've tried to answer your question, since ironically the error appears to be in your cryptography rather than your python. In general, questions here shouldn't involve large amounts of code, since the aim should be the study of cryptography as a theoretical science, rather than programming –  figlesquidge Mar 26 '14 at 13:33
@figlesquidge Good catch! Guess this is one of the rare cases that proves questions with code can be on-topic… oh, the irony – always good enough to make me smile on a rainy day. ;) –  e-sushi Mar 26 '14 at 16:16

1 Answer 1

up vote 3 down vote accepted

Just for completeness sake, CBC is defined as follows: CBC mode

The error you have made is that:

$$M;N = (M_1, ..., M_n, N_1 ⊕ \mathbf{T_m}, N_2, ..., N_n)$$ (I've changed notation from M||N to M;N to reflect this isn't just concatenation)

You need to cancel the tag from the message $M$, not the tag from the $N$ message. In that case, $T_{M;N}=T_N$ as required.

share|improve this answer
Thank you for your correction! It helped a lot! –  Giuseppe Cazzato Mar 26 '14 at 14:16
Don't forget to mark it as closed then! :) –  figlesquidge Apr 1 '14 at 9:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.