# Tag Info

1

The CBC-MAC construction indeed can use a PRF instead of PRP. It is now based on PRP due to historical reasons: the blockciphers used for CBC-MAC were based on permutations. From the security point of view there will be no difference: the security proof for the CBC-MAC first converts PRP to PRF (which is indistinguishable up to $2^{n/2}$ queries) and then ...

1

If you use the hash as a known key, then you do not need any additional authentication to ensure plaintext integrity. An attacker cannot find another plaintext with that hash value unless the hash is broken. However, there are two problems with that: Like MAC-then-encrypt the hash only ensures authenticity of the plaintext, not of the ciphertext. This ...

1

As additional detail, while the two keys need to be distinct and secret, you can derive the CBC-MAC key and the CBC encryption key from the same master key. Generate a random master key, then use any key derivation algorithm with two different salts to derive the authentication and encryption keys. For example, $K(m, \text{'auth'})$ and $K(m, \text{'enc'})$ ...

4

From the sound of your questions, it almost appears that you have some confusion between the CBC-MAC key and the CBC-MAC tag. The CBC-MAC algorithm takes the message (in this case, most likely the ciphertext) and a secret key; it outputs a tag (which can be public). The security property of CBC-MAC is that someone who does not know the key cannot generate ...

Top 50 recent answers are included