Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Lets say that we use init vector IV, key K and HMAC key H. Message is M.

Mode of operation is CBC !!!

We usually encrypt this way:

C = crypt(M,K,IV) #encrypted data  
R = C + MAC(C)  # final result and + is for con cat

But we could just use:

R = len + crypt(M + H,K, IV)  # notice M + H

Is there something wrong with such a scheme? It looks much faster to me and requires like half the computation and complexity.

share|improve this question
    
Yes, it does not give message authenticity and it leaves crypt accessible to chosen-ciphertext attacks. –  Ricky Demer Jul 30 '12 at 10:48
    
If HMAC is too slow for you, I'd look into authenticated encryption modes. They use much faster MAC techniques. –  CodesInChaos Jul 30 '12 at 11:36
add comment

1 Answer 1

up vote 7 down vote accepted

This scheme is totally insecure. If an attacker modifies any part of the ciphertext except the last block before the ciphertext corresponding to H, your scheme won't catch it.

CBC decryption of a block only depends on the ciphertext of the previous and current block.Illustration

(Based on Cbc decryption.png from Wikipedia)

The red parts are left totally unprotected by your MAC scheme. The green parts affect your MAC, but even on them there are some attacks.

share|improve this answer
    
Oh, I see, what about replacing whit some other mode. That propagates trough all –  ralu Jul 30 '12 at 11:31
    
That depends on the exact mode. –  CodesInChaos Jul 30 '12 at 11:36
    
Crazy, I just had a similar thought earlier today after getting pissed off at HMAC, but using CFB instead. I came to the same conclusion after a few minutes, the diagram illustrates it all very neatly, +1. –  Thomas Jul 30 '12 at 13:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.