3
$\begingroup$

In the CBC-MAC algorithm as given in the image below, I have two questions:

  1. It is said that the CBC-MAC is simply the last block of ciphertext if the message is encrypted using CBC block cipher mode, and I don't understand what this means
  2. How does encryption with CBC even work for schemes such as this where encryption is nested. Do we work from inside to out and use the previous result as the input message block?

enter image description here

Improve this question
$\endgroup$
5
  • $\begingroup$ 1. discard all ciphertext but the last. 2. This is a recursively written CBC ( CBC-MAC) $\endgroup$
    – kelalaka
    Commented May 5 at 18:16
  • $\begingroup$ @kelalaka So in this encryption what keys do we use are they the same throughout. I read about an attack where the keys used fro encryption and MAC are the same but isn't there only one key $\endgroup$
    – revision
    Commented May 5 at 18:24
  • $\begingroup$ Little search : Why is ECBC-MAC with one key insecure? $\endgroup$
    – kelalaka
    Commented May 5 at 18:27
  • $\begingroup$ @kelalaka Is that the same algorithm I am using, I am a little confused as to when it refers to encryption using a separate key to the MAC, does it mean the multiple Ek in the construction of the MAC or is it that we usually encrypt after computing the CBC_MAC $\endgroup$
    – revision
    Commented May 5 at 18:35
  • 1
    $\begingroup$ Dear friend, one is always welcome to ask questions where they have problems - with a proper question. It seems that you are on the learning path. My advice read some books like Lindell&Katz or similar ones, and look for Dan Boneh's course over coursera. $\endgroup$
    – kelalaka
    Commented May 6 at 22:14

1 Answer 1

Reset to default
2
$\begingroup$

It is said that the CBC-MAC is simply the last block of ciphertext if the message is encrypted using CBC block cipher mode, and I don't understand what this means

What you show in the question is a mathematical description of the CBC MAC mode. However, this question is easier to understand if you look at the CBC-MAC picture on Wikipedia:

enter image description here

Benjamin D. Esham (bdesham) - Own work based on: Cbcmac.png by en:User:PeterPearson

Normally the ciphertext blocks are simply the ciphertext output for each $E$ function in the picture.

Note that there are two other differences with CBC mode as it is commonly used:

  1. the all-zero IV and
  2. the bit padding mode is used, usually PKCS#7 compatible padding is used instead (not showing in the picture, not in the indicated algorithms).

The all-zero IV is not shown in the picture you've posted. I'd also stipulate that if the message size is zero the MAC output is not just the IV. Instead, because bit padding is always applied you would simply send an encryption of the bit padding. So in that sense, the formula is erroneous.

How does encryption with CBC even work for schemes such as this where encryption is nested. Do we work from inside to out and use the previous result as the input message block?

Yes, however in that case such a nested structure in your picture does not make much sense, as you would get output for each iteration.

Again, I'd not even say that the IV is part of the ciphertext, so the formula would simply be:

$$c_i = \begin{cases} E_k(IV \oplus p_0) & \text{if } i = 0 \\ E_k(c_{i - 1} \oplus p_i) & \text{if } i \neq 0 \end{cases} $$

It should be clear that if you take the final ciphertext $c_n$ and then iteratively substitute $c_{i-1}$ with the definition you get back your CBC-MAC formula - except for the erroneous IV part as indicated.

Or you could again create a picture such as above (compare this with the first picture shown in the answer!):

enter image description here

WhiteTimberwolf (SVG version)

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.