4
$\begingroup$

XCBC paper says all three keys should be independent. It doesn't say they must always be different. However it seems this is necessary to differentiate padded message and message without padding.

Lets say we derive all three keys so that key 2 and key 3 might be the identical (randomly). Is it secure?

$\endgroup$
3
  • 2
    $\begingroup$ I guess the referenced paper is John Black and Phillip Rogaway's CBC MACs for Arbitrary-Length Messages: The Three-Key Constructions (in proceedings of Crypto 2000, or 2003 version). $\;$ If we draw key randomly, the system is secure, because keys 2 and 3 are identical with infinitesimal odds. I think a more practically interesting question is: Is the system secure if we derive two keys K1 and K2 randomly, and set K3=K2. $\endgroup$ Nov 3, 2014 at 18:12
  • 2
    $\begingroup$ Being the same key is like the overlord of being dependant on each other. $\endgroup$
    – Nova
    Nov 3, 2014 at 19:47
  • $\begingroup$ I agree with fgrieu but I'll try and put it more succinctly: if the keys are independent, they should be different. $\endgroup$ Nov 6, 2014 at 1:45

1 Answer 1

5
$\begingroup$

If key 2 and key 3 has a nonnegligible chance to be the same, then the attacker has a nonnegligible chance of being able to generate a valid (Message, MAC) pair.

Here's how it works, if the message is not a multiple of 16, then XCBC pads the message out to the next multiple of 16; if it already is, the message remains the same.

Then, XCBC logically does a CBC mode encryption (using key 1); except that when it gets to the last block, it xor's in either K2 (if no padding was added) or K3 (if padding was added) before the final encryption.

Note that this padding operation is public; anyone can compute it.

What the attacker would do is request the MAC of a message M (which is not a multiple of 16); he gets a valid T.

Then, the pair (Pad(M), T) has a nonnegligible chance of being also valid; if K2==K3, then the message will be a multiple of 16, and so no padding is added; XCBC will xor in K2, but since K2==K3, that'll give the same result as the corresponding step during the query, and the final encryption will also be the same.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.