# Tag Info

9

It is not secure, because an attacker can "mix and match" the output blocks from different authentication tags on different input messages, or repeat output blocks for repeated input blocks. For example, if the attacker knows the tag $F_k(m)$ for a one-block message $m$, then it can forge the correct tag $F_k(m) \mid F_k(m)$ for the two-block message $m ... 7 The other answer is correct in general. However, if your messages are all exactly one block long (or all one block after padding), ECB is a secure MAC. A PRP looks like a PRF up to half its bit length, i.e. up to$2^{64}$blocks for AES. A secure PRF is a secure MAC of the same size. Thus, AES ECB used on 128-bit messages is a secure MAC as long as you use ... 3 An answer surfaced from careful reading of appropriate documentation. The MAC in the question is also defined in ANSI X9.19, and is supported by some PKCS#11 tokens as the mechanism CKM_DES3_X919_MAC_GENERAL. Other than that, this MAC can be simulated using CKM_DES_MAC_GENERAL (or CKM_DES_CBC or CKM_DES3_CBC) for all but the last block, then CKM_DES3_CBC; ... 2 Yes, the MAC algorithm works the same way on both sides. It is a mathematical function that computes the tag from the key and the message. On the sender side, the message is processed as follows: Calculate T = MAC(key, raw_message). Send the raw_message and the tag value T. Many communication protocols append them in this order but anything will do as long ... 2 How about GMAC? It's a Carter-Wegman MAC that meets the requirements of being fast to compute, and parallelizable. In addition, it can be securely updated, that is, given a long message, you can compute the MAC of a modified version of that message faster than recomputing the entire MAC. For example, suppose you have a message/nonce/tag triple of$(N, M, ...

1

Can $A$ assume that only $B$ can read the message? Only someone with the private key corresponding to $P_B$ can read the message. If $A$ can assume that only $B$ has it, that works. As $B$ does not know anything about $A$ what is the cryptographic purpose of the MAC? So that someone else cannot modify the encrypted message. What we want to ...

1

Actually the HMAC value is not decrypted at all. The recipient takes all the needed input and she computes the HMAC on her own side and check if the result she got it is equal to the value on the message she got. You can roughly see the HMAC algorithm as an symmetric key signature. You cannot decrypt an HMAC, you only check that the value is correct.

1

Here are some advantages and disadvantages for each of the three classes of MACs, which I know about: Based on block cipher There are constructions where the security of the MAC is proven in terms of the security definition of a block cipher. This means as long as the block cipher is secure, the MAC will be secure. There are constructions where encryption ...

Only top voted, non community-wiki answers of a minimum length are eligible