3
$\begingroup$

I use AES both CBC and CBC-MAC to encrypt some stuff. I generate one key for CBC and one different key for CBC-MAC.

  1. Does the second key (for CBC-MAC) need to be secret?
  2. How to join such key with the ciphertext? By contatenating it at the end?
$\endgroup$

2 Answers 2

4
$\begingroup$

From the sound of your questions, it almost appears that you have some confusion between the CBC-MAC key and the CBC-MAC tag.

The CBC-MAC algorithm takes the message (in this case, most likely the ciphertext) and a secret key; it outputs a tag (which can be public). The security property of CBC-MAC is that someone who does not know the key cannot generate a valid message, tag pair, even if he sees a huge number of valid message, tag pairs (of course, he is not allowed to suggest a message, tag pair that he has been given). Actually, it works even if he is allowed to specify the messages.

The idea is that if the receiver (Bob) gets a message and tag pair that validates, that means that the sender (Alice) must have generated it. After all, only someone who knows the key is able to generate such a pair, and the only two are Alice and Bob (and Bob knows he'll never generate such a pair, so Alice must have sent it).

With that in mind, your questions:

Does the second key (for CBC-MAC) need to be secret?

Absolutely; if the attacker is given that key, then all security bets are off. He can easily generate a valid MAC tag for any message he picks.

How to join such key with the ciphertext? By concatenating it at the end?

No, you don't send out the key with the ciphertext; it needs to be secret. On the other hand, you can send the tag with the ciphertext; concatenating the tag at the end is one common approach.

$\endgroup$
2
  • $\begingroup$ Thanks. So I need to send to the sender - in private - both key for CBC and key for CBC-MAC ? $\endgroup$
    – Kingland
    Aug 21, 2014 at 18:17
  • $\begingroup$ @Kingland: yes (or somehow otherwise have both sides arrive at the same secret keys) $\endgroup$
    – poncho
    Aug 21, 2014 at 18:23
1
$\begingroup$

As additional detail, while the two keys need to be distinct and secret, you can derive the CBC-MAC key and the CBC encryption key from the same master key.

Generate a random master key, then use any key derivation algorithm with two different salts to derive the authentication and encryption keys. For example, $K(m, \text{'auth'})$ and $K(m, \text{'enc'})$ where $K$ is the key derivation function, like HKDF.

That way you do not need to share any more keys than with unauthenticated encryption.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.