5
$\begingroup$

I'm reading the Handbook of Applied Cryptography by ‎Alfred J. Menezes et al. Especially, I'm stuck with the case that reusing key for CBC encryption and CBC-MAC in MAC-then-encrypt structure.

My question is: in MAC-then-encrypt structure, that textbook's p.367 states

Example (improper combination of CBC-MAC and CBC encryption) Consider using the data integrity mechanism of equation $\big(\ C'=E_k(x\mathbin\|h_{k'}(x))\ \big)$, with $E_k$ being CBC-encryption with key $k$ and initialization vector $IV$, $\ h_{k'}(x)$ being CBC-MAC with $k'$ and $IV'$, and $k=k'$, $IV=IV'$. The data $x=x_1\mathbin\|x_2\mathbin\|\ldots\mathbin\|x_t$ can then be processed in a single CBC pass, since the CBC-MAC is equal to the last ciphertext block $c_t=E_k(c_{t−1}\oplus x_t)$, and the last data block is $x_{t+1}=c_t$, yielding final ciphertext block $c_{t+1}=E_k(c_t\oplus x_{t+1})=E_k(0)$. The encrypted MAC is thus independent of both plaintext and ciphertext, rendering the integrity mechanism completely insecure. Care should thus be taken in combining a MAC with an encryption scheme. In general, it is recommended that distinct (and ideally, independent) keys be used.

Why is it problem that MAC is independent of both plaintext and ciphertext? Are there any instances where an attacker could use this fact? (I know that MAC-then-encrypt structure vulnerable to padding oracle attack.. however, in that case, the attacker could perform the actual attack.) I think that encrypted MAC part always results in 0 being encrypted, but there is no practical way to exploit this fact. Isn't it?

Improve this question
$\endgroup$
4
  • 3
    $\begingroup$ Hint: assume you intercept an encrypted+MACed block, and change one bit of what the legitimate receiver gets. On what condition will the modified block be nevertheless accepted by the receiver? Perhaps, generalize for more bits and otherwise altered messages. Will the decrypted plaintext be changed? Does that goes against the security definition of a cipher ? Of a MAC? $\endgroup$
    – fgrieu ♦
    May 2, 2020 at 11:45
  • $\begingroup$ @fgrieu I got this fact. Let C = C1||C2||C3||...||Cn. and corresponding plaintext : X = X1||X2||X3||...||Xn. If I change 1 bit of C2, then that affects X2, X3. And it will eventually have the same value as the previous tag(MAC process). If different key used(encryption, MAC) in such a situation, the error would have been detected during the MAC verification process. But, how does that relate to the last block of ciphertext being encrypted with 0? $\endgroup$
    – pioneer
    May 2, 2020 at 12:50
  • $\begingroup$ "how does that relate to the last block of ciphertext being encrypted with 0?": not, and no, the last block of ciphertext is not encrypted with 0. The quote's statement is that the last block of ciphertext is 0 encrypted with the key, and that therefore it is constant. But you did not ask why is the last block of ciphertext 0 encrypted with the key nor why is the last block of ciphertext constant (hint; that involves $\forall x,\ x\oplus x=0$). You asked "Why is it problem that MAC is independent of both plaintext and ciphertext?" (hint: it does not hold). $\endgroup$
    – fgrieu ♦
    May 2, 2020 at 15:48
  • $\begingroup$ @fgrieu My intention seems to have been misrepresented. I understood the fact that the last block of ciphertext is 0 encrypted with the key, and that therefore it is constant. I'm just curious why in the last quote that they emphasize that the last block is a constant. Even if they don't mention it, if they change C2 (as I mentioned method above.. they affect only X2, X3..(decrpytion process), then get the same MAC.. isn't it? My point is.. "Why is the comment needed that encrypted MAC part is constant?" $\endgroup$
    – pioneer
    May 3, 2020 at 6:13

1 Answer 1

Reset to default
3
$\begingroup$

Why is the comment needed that encrypted MAC part is constant?

With the scheme in the question, in a cryptogram with the correct MAC, the last block of the encrypted message is a constant. Importantly, that goes both ways: if the last block of the encrypted message is that constant, then the MAC is correct and whatever plaintext is deciphered will pass the MAC test.

This allows forgery: an adversary can observe one encrypted message, get that constant, and from then on forge encrypted messages that will pass the MAC check after decryption. That goes against the purpose of ensuring integrity of the (deciphered) message.

We combined a secure encryption, and a secure MAC (for constant message length), and got an insecure combination (w.r.t. the goal of the MAC) because we did not obey the principle: a key shall only serve one purpose (or: one usage, one key).

In the context, it gets worse than letting garbage pass the MAC check: CBC encryption is malleable enough that the adversaries can partially choose the deciphered plaintext. For example, with a long known plaintext, they can copy/paste large segments of ciphertext, cutting at block boundaries, and that does the same for deciphered plaintext, albeit with one block of garbage after each cut. Other example (that can combine): an adversary can put an arbitrary chosen value one block wide in the deciphered plaintext, by putting it in a ciphertext block followed by a copy of the last block $E_k(0)$.

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ Perfect explanation. I got it. $\endgroup$
    – pioneer
    May 3, 2020 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.