Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

CBC-MAC, with fixed length message.

Is it safe to return all ciphered blocks instead of the last?

My intuition says it is less secure, since is gives an attacker more information. But how could one attack this scheme?

share|improve this question
Why you want to do that? What is the scenario? – curious May 3 '13 at 10:47
I'm not seeing a practical use of this. I just want to know, in theory, why this is insecure. – danieltorres May 3 '13 at 11:13
up vote 9 down vote accepted

I'll assumme All ciphered blocks means the same as ciphertext for CBC-Encryption with implicit zero IV, while CBC-MAC is the last block of that.

All ciphered blocks is unsafe as a message authenticator for messages longer than one block, for it succumbs to a trivial attack (here with two blocks):

  • Eve intercepts message $M=M_0||M_1$ and its authenticator $A=A_0||A_1$
  • she knows $A_0=E(M_0)$ and $A_1=E(A_0\oplus M_1)$
  • she builds $M'=(A_0\oplus M_1)||(A_1\oplus M_0)$ and its authenticator $A'=A_1||A_0$.

The verifier will then accept as valid $M'$ and its authenticator $A'$ just as well as $M$ and its authenticator $A$.

Addition for completeness: $M'\ne M$ unless $M_1=M_0\oplus E(M_0)$, which is extremely unlikely to occur by chance.

share|improve this answer
I can't believe the #523 corrected the #9,725 :) – curious May 7 '13 at 8:29
@curious Even the best authors make typos ... and when not native in English (as me and fgrieu), we tend to overlook them sometimes. Luckily Crypto SE reputation doesn't mirror mainly English language knowledge. Thanks for your correction, and feel free to suggest edits wherever you find typos or other kind of mistakes. (When it is not totally obvious that it is a mistake, a comment might be better, though.) – Paŭlo Ebermann May 11 '13 at 22:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.