1
$\begingroup$

I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is based on a known-plaintext attack to create a valid (ciphertext, nonce, tag)-tuple. I already figured out how I can create a new message to get the same tag with a given pair (M,T):

M1 = M xor T => T = H_K1(M) = H_K1(M||M1)

Then I already figured out that I can get the keystream of a given (message, nonce, ciphertext, tag)-tuple:

KS = M xor C

But now I don't get it, how I can create another valid (nonce, ciphertext, tag)-tuple with these information.

Thanks for any ideas in advance.

$\endgroup$

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.