New answers tagged


"Given the above assumptions and limitations, is the encryption scheme still secure?" No; the attacker can remove blocks of [IV + rest_of_ciphertext] from either end to remove corresponding plaintext blocks without affecting any other part of what it decrypts to change the IV to change the initial plaintext block in the same way as for the OTP, without ...


It's also worth considering the point of a MAC in the first place, i.e. - why it should be calculated over all of the input rather than just the first block. Making the tag dependent on only the first block of the tag would allow an attacker to fill in the rest of the message with whatever they wanted, so long as the first block of CT represented a valid ...


The MAC value should be calculated over all of the input, not just the first block. The chaining of CBC makes sure that the bits in the last block of ciphertext depends on all the previous blocks.


Consider the following chosen-plaintext attack on the modified CBC-MAC function: Send $m_1$, $m_2$, $m_3$, receive $t_1$, $t_2$, $t_3$. Send $m_1$, $m'_2$, $m'_3$, receive $t'_1$, $t'_2$, $t'_3$. Send $t'_2 \oplus m''_3$, $m''_2$, $m''_3$, receive $E_k(t'_2 \oplus m''_3)$, $t''_2$, $t''_3$. Then you know the following (message, tag) pair will verify: ...

Top 50 recent answers are included