What block cipher is used for CBC-MAC? DES, AES, 3DES? Or it doesn't matter?


Well, yes, it does matter; however the terminology 'CBC-MAC' does not specify which.

CBC-MAC is a generic construction that takes an arbitrary block cipher, and turns it into an object that acts like a MAC for fixed length messages (much like CBC mode is a generic construction that takes an arbitrary block cipher, and turns it into a object that encrypts variable length messages). And, just like "CBC" isn't necessarily used with a specific block cipher, neither is CBC-MAC.

Note: CBC-MAC has issues if you try to use it with variable length messages; CMAC and XCBC are two modes similar to CBC-MAC that avoid this problem.

  • 2
    $\begingroup$ I prefer to say that CBC-MAC is a construction that constructs a MAC from an arbitrary block cipher. If the block cipher is secure and we restrict to fixed-length messages, the MAC is also secure. For variable-length messages, the MAC is insecure regardless of block cipher. $\endgroup$ – K.G. Oct 22 '13 at 11:48

CBC-MAC is a MAC construction based on a block cipher. Any block cipher will do, but the security of the scheme is reducible to the security of the block cipher. To put it more precisely, any block cipher will make a secure CBC-MAC as long as that block cipher is a secure pseudorandom permutation.

  • $\begingroup$ Actually, the security of CBC-MAC as a MAC is not reducible to the security of the block cipher. For example, if we ignore padding, and $A$ and $B$ are messages with lengths a multiple of the block size, then if $CBCMAC(A) = X$ and $CBCMAC(A|X) = Y$ and $CBCMAC(B) = Z$, then we can deduce that $CBCMAC(B|Z) = Y$; this is a violation of the MAC properties. Including padding complicates this attack, but not enough to make it infeasible. $\endgroup$ – poncho Oct 21 '13 at 20:11
  • 1
    $\begingroup$ Yeah but this violates the definition of CBC-MAC, namely that it acts on messages of fixed length. $\endgroup$ – pg1989 Oct 21 '13 at 21:43
  • $\begingroup$ CBC-MAC is fine with variable length messages, as long as you never have one message that's a prefix of another. For example a length prefix can achieve that if you know the length of the message beforehand. $\endgroup$ – CodesInChaos Oct 22 '13 at 16:39

First the block cipher can take on more than one general form provided certain criteria are met and in terms of: block cipher, Fk, secure CBC-MAC,and of course CBC mode. Pseudo random generators and permutations as an aside an in response to above are very related in terms of inversion. In symbols F:K*X---> PRP. If a given block cipher is secure this does not make the MAC secured, vice verse a secure CBC-MAC/CBC-MODE does NOT make a secure block cipher. In MAC engineering and cryptology in general there are many paths to exploitation. While Wikipedia and other sites get PRP and PRG somewhat correct and hint at or briefly mention prepending they do a poor job at actually explaining the finer points that matter in this discussion. As long as the block cipher meets certain minimum requirements then it is suitable for the CBC-MAC.

                     Please see below for more details:

CBC-MAC Handles arbitrary length messages and more specifically message much longer than a single block Length. The message can be of arbitrary but fixed length. Both sender and receiver must agree on the length of the message beforehand in theory, but this is not realistic in practice so messages can be changed in length via a few methods, but one practical one is prep-ending the length of the message where: to authenticate a message m1--ml where l can take on any value l will be coded as a single block using n bits perhaps padding to the left with 0's then run the CBC-MAC system m1--ml messages and will handle any arbitrary message of any length l.

Given a message m1--ml where each Mi represents a block of the message whose length is = to the block length of SOME underlying block cipher we can compute a tag by applying the block cipher Fk (effs of k) to the initial block M1 value then use it as a chaining value and xor to M2 and all through the same until a result: a tag t of the message m1--to ml.CB-MAC is also deterministic unlike CBC mode which itself has IV = initiation vector which would make if used CBC-MAC insecure.However,both CBC and mode are necessary to be secure. Finally, the element t must be mapped to set x by a separate key k in the Key space.Without this final encryption function, this function is known as a cascade function and it is not secure. Yet the fpad at the end matches mode functions to protect the Block cipher.

Interestingly hash functions are related to CBC-MAC/CBC MODE and they are an engineered response to some MAC issues.


Dan Boneh Cryptography I Coursera/Stanford.

Jonathan Katz Cryptography Coursera/University of Maryland


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.