# AES CBC MAC splicing attack

I'm trying to implement AES CBC MAC splicing attack in Python, the idea is:

given a message M, its tag Tm (MAC(M) = T), a new message N and its tag Tn we build a message such as: M||N = (M1, ..., Mn, N1 ⊕ Tn, N2, ..., Nn) that has the same tag with N (that is because you inserted a block which resets the algorithm).

The idea is quite clear, but I still cannot get the correct tag.

Here is my code (I'm new to Python, sorry):

from Crypto.Cipher import AES
from Crypto.Util.strxor import strxor
from binascii import hexlify
import argparse
import pickle

AES_KEY_SIZE = 16
BLOCK_SIZE = AES.block_size

def main():
parser = argparse.ArgumentParser()
args = parser.parse_args()
with open(args.tag2, "rb") as tag2:
with open(args.k, mode="rb") as f:
assert len(key) == AES_KEY_SIZE
cipher = AES.new(key, AES.MODE_CBC, b'\0' * BLOCK_SIZE)
with open(args.f2, mode="rb") as f2:
b1 = cipher.encrypt(strxor(f2_block1, stored_tag))
with open(args.f1, mode="rb") as f1:
the_rest_of_the_file = file2[BLOCK_SIZE:len(file2)]
new = open('newfile.file','w')
s = file1 + b1 + the_rest_of_the_file
new.write(s)

if __name__=="__main__":
main()

-
I've tried to answer your question, since ironically the error appears to be in your cryptography rather than your python. In general, questions here shouldn't involve large amounts of code, since the aim should be the study of cryptography as a theoretical science, rather than programming –  figlesquidge Mar 26 '14 at 13:33
@figlesquidge Good catch! Guess this is one of the rare cases that proves questions with code can be on-topic… oh, the irony – always good enough to make me smile on a rainy day. ;) –  e-sushi Mar 26 '14 at 16:16

Just for completeness sake, CBC is defined as follows:

The error you have made is that:

$$M;N = (M_1, ..., M_n, N_1 ⊕ \mathbf{T_m}, N_2, ..., N_n)$$ (I've changed notation from M||N to M;N to reflect this isn't just concatenation)

You need to cancel the tag from the message $M$, not the tag from the $N$ message. In that case, $T_{M;N}=T_N$ as required.

-
Thank you for your correction! It helped a lot! –  Giuseppe Cazzato Mar 26 '14 at 14:16
Don't forget to mark it as closed then! :) –  figlesquidge Apr 1 '14 at 9:02