I found this question about CBC-MAC forging and want to make sure I understand it:

Let a and be be two strings of block length one. Suppose the sender sends $(a, \text{CBC-MAC}(a)), (b, \text{CBC-MAC}(b)), (a||b, \text{CBC-MAC}(a||b))$. Find new messages / MAC pair which the attack can now forge from the messages / MACs given above.

I have: $\text{CBC-MAC}(x) = t$ and $\text{CBC-MAC}(y) = t'$,
then $\text{CBC-MAC}(x || y \oplus t) = t'$.
Then can I forge the permutation combination of the given pairs with that formula? i.e. if $\text{CBC-MAC}(a) = x$ and $\text{CBC-MAC}(b) = y$, then $\text{CBC-MAC}(a || b \oplus x) = y$.

  • $\begingroup$ CBC-MAC(x || y $\oplus$ t) = t' is to be read as CBC-MAC(x ||(y $\oplus$ t)) = t' with t right-padded with enough zeros to match the length of y . $\endgroup$
    – fgrieu
    Nov 6, 2013 at 14:11
  • $\begingroup$ which textbook is this from? I can't find this is any Cryptography textbook $\endgroup$
    – user9293
    Nov 7, 2013 at 21:10

1 Answer 1


Yes, your understanding is correct. With the CBC-MAC's of $(a), (b)$ and $(a||b)$ you can forge the following new messages:

$(a||b \oplus MAC(a)), \\ (b||a \oplus MAC(b)), \\ (b||b \oplus MAC(b)),\\ (a||a \oplus MAC(a)),\\ (a||b||a \oplus MAC(a||b)), \\ (a||b||b \oplus MAC(a||b)), \\ (a||b \oplus MAC(a)||a \oplus MAC(b))\\ (a||b \oplus MAC(a)||b \oplus MAC(b))\\$

...And so on and so forth until you get tired of pwning CBC-MAC with forgeries (assuming the recipient accepts messages longer than the one-to-two blocks we know from the question).


Not the answer you're looking for? Browse other questions tagged or ask your own question.