I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
2
-
2$\begingroup$ There is a pretty good explanation on Wikipedia. Is there anything that you do not understand from that description? It would be nice if you could make your question less generic, and indicate which parts you are unsure about. $\endgroup$– Maarten Bodewes ♦Commented Oct 3, 2022 at 8:58
-
1$\begingroup$ Does this answer your question? Insecurity of CBC-MAC $\endgroup$– Gilles 'SO- stop being evil'Commented Mar 17, 2023 at 9:17
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
Let's assume that the first tag on plaintext $P=[P_1,\ldots,P_n]$ is calculated as;
\begin{align} C_1 &= E_k(O \oplus P_1)\\ C_2 &= E_k(C_1 \oplus P_2)\\ \vdots & \quad\quad\vdots \\ C_n &= E_k(C_{n-1} \oplus P_n)\\ t &= C_n \end{align}
and the second tag for plaintext $Q =[Q_1,\ldots,Q_m]$ as;
\begin{align} C_1' &= E_k(O \oplus Q_1)\\ C_2' &= E_k(C_1' \oplus Q_2)\\ \vdots & \quad\quad\vdots \\ C_m' &= E_k(C_{m-1}' \oplus Q_m)\\ t' &= C_m' \end{align}
Now, can we combine these two?
Yes, with a little modification we will have a new message with the tag $t'$. Consider $$m = [P_1,P_2,\ldots,P_n, \color{red}{Q_1 \oplus C_n},Q_2,\ldots,Q_m]$$
The process of the $P_i$'s is obvious from the first message. Now, Concentrate on the $\color{red}{\text{red}}$ part while $C_n$ is taken as the IV of the next block from the CBC chain;
$$E_k( C_n \oplus (Q_1 \oplus C_n)) = E_k(0 \oplus Q_1) = C_1'$$
Now, the process of the rest is the same as the second tag. This makes forgery if the message length is not incorporated into the tag calculation.
answered Oct 3, 2022 at 22:15