Tagged Questions
6
votes
1answer
1k views
Why is it insecure to use a randomized IV for CBC-MAC instead of an all-zero IV?
A fixed length CBC-MAC uses an all-zero block as the initialization vector.
Suppose that we used a randomized IV instead, and sent the IV along with the tag.
So if the message $m$ will be $m = b_1 || ...
