# Tag Info

9

I'll assumme All ciphered blocks means the same as ciphertext for CBC-Encryption with implicit zero IV, while CBC-MAC is the last block of that. All ciphered blocks is unsafe as a message authenticator for messages longer than one block, for it succumbs to a trivial attack (here with two blocks): Eve intercepts message $M=M_0||M_1$ and its authenticator ...

5

The problem with CBC-MAC for variable-length messages is that CBC-MAC applied to a one-block message essentially amounts to an oracle for evaluating the block cipher at values of the adversary's choice. And that oracle allows an adversary to break the scheme. Consider first CMAC restricted to messages that consist of a whole number of blocks. Then the ...

5

The quoted sentences means: if there is a collision among the MACs of the $2^{(n+1)/2}$ messages submitted, the attacker playing the distinguishing game announces that the oracle is a random function; else announces that the oracle is CBC-MAC. This works because the messages submitted differ only in their first block, thus will never collide under CBC-MAC, ...

5

Because CBC-MAC with inputs that are not prefix free is weak against existential forgery, meaning it is not a "secure" MAC. More precisely, CBC-MAC is easily distinguishable from a random function (i.e. not a PRF) when the input domain is not prefix-free. This is because an adversary can request the CBC-MAC of messages $M_0$ and $M_1$, and then xor the MAC ...

5

Well, yes, it does matter; however the terminology 'CBC-MAC' does not specify which. CBC-MAC is a generic construction that takes an arbitrary block cipher, and turns it into an object that acts like a MAC for fixed length messages (much like CBC mode is a generic construction that takes an arbitrary block cipher, and turns it into a object that encrypts ...

5

Well, let's try it, and see how hard it is to forge a message. Let's say for illustrative purposes that each character is a block, and that numbers represent the length indicator section. And let's start by putting the length indicator at the end. So, XXXXXXX7 represents a 7-block message, with the '7' indicator at the end. Let's also say that, ...

4

The identification of the lexicographically first irreducible degree-b binary polynomial with the minimal number of ones can be implemented by testing reducibility (second algorithm) of those polynomials in order until you get to the first irreducible polynomial in that order. Alternatively, you could look them up. The constant itself is then derived from ...

4

why overcomplicate it like that, D1 and D2 generates random 64-bit P they send it to each other both generate AES(key,P_own||P_other) and again send to each other (note that these are different for each) then both can verify that what they received is equal to AES(key,P_other||P_own) upside here is that it is a symmetric protocol

4

1) The adversary queries the oracle (with some randomly chosen message $m$) and gets as a result a message $m=m_1|m_2|...$ and its tag $t=(t_0,F_{k_2}(t_r))$. She then draws $\rho$ uniformly at random in $\{0,1\}^n$ and outputs the message $m=\rho\oplus m_1|m_2|...$ and its (valid) tag $t=(\rho\oplus t_0,F_{k_2}(t_r))$. 2) The adversary queries the oracle ...

4

Yes. Assume that the attacker knows the ciphertext $c = c_1 \mathbin\| c_2$, the initialization vector $v$ and the plaintext $m = m_1 \mathbin\| m_2$. This tells them that $D_k(c_1) = m_1 \oplus v$ and $D_k(c_2) = m_2 \oplus c_1$, where $D_k(\cdot)$ denotes block cipher decryption under the (unknown) key $k$. In particular, this implies that, if the ...

2

Hash (message digest) and MAC (message authentication code) are a different thing. CBC-MAC turns block cipher into MAC. HMAC turns hash function into MAC. A good reason to use CBC-MAC would be that a MAC is needed and there is a suitable implementation of sufficiently secure block cipher available. For instance, many of recent Intel-based processors have ...

2

A hash function is not a MAC, although you can turn it into a MAC (see e.g. HMAC). The purpose of a MAC is message authenticity / integrity -- to prevent attackers (i.e. people who don't know the secret key) from modifying the message or forging fake messages. A hash function trivially cannot fulfill the function of a MAC, because hash functions are ...

2

Why approximately $2^{(n+1)/2}$ queries? Because it makes the attack work. As far as your final comment, it sounds like you are confusing $(n+1)/2$ with $2^{(n+1)/2}$. If we use AES, then $n=128$, so $(n+1)/2=64.5$. However, $2^{64.5}$ is a very large number. The exact number of queries is not important as long as it is approximately $2^{64.5}$, and it ...

1

Yes, your understanding is correct. With the CBC-MAC's of $(a), (b)$ and $(a||b)$ you can forge the following new messages: $(a||b \oplus MAC(a)), \\ (b||a \oplus MAC(b)), \\ (b||b \oplus MAC(b)),\\ (a||a \oplus MAC(a)),\\ (a||b||a \oplus MAC(a||b)), \\ (a||b||b \oplus MAC(a||b)), \\ (a||b \oplus MAC(a)||a \oplus MAC(b))\\ (a||b \oplus MAC(a)||b \oplus ... 1 CBC-MAC is calculated by iterating a block cipher in CBC mode over the blocks of the message, using a start value of 0 - i.e.$CBC{-}MAC(a)$is actually$CBC{-}MAC(0,a)$. Since the first part of the messages (i.e.$a$,$b$) in your example have sizes that are multiples of the block length, the$CBC{-}MAC\$ of each of them creates a chaining value that can be ...

1

CBC-MAC is a MAC construction based on a block cipher. Any block cipher will do, but the security of the scheme is reducible to the security of the block cipher. To put it more precisely, any block cipher will make a secure CBC-MAC as long as that block cipher is a secure pseudorandom permutation.

Only top voted, non community-wiki answers of a minimum length are eligible