Why not just apply hash function on the whole message? Why convert that message into blocks and hash those blocks? To avoid collisions?

  • 1
    $\begingroup$ 1) Hash != MAC 2) Most hash functions divide the message into blocks internally 3) MACs don't need to be collision resistant, and CBC-MAC isn't. 4) I don't get your questions $\endgroup$ – CodesInChaos Jan 7 '14 at 15:57
  • $\begingroup$ possible duplicate of Can I jettison MAC if I already have SHA1(M)? $\endgroup$ – Trina Jan 7 '14 at 20:38

A hash function is not a MAC, although you can turn it into a MAC (see e.g. HMAC).

The purpose of a MAC is message authenticity / integrity -- to prevent attackers (i.e. people who don't know the secret key) from modifying the message or forging fake messages. A hash function trivially cannot fulfill the function of a MAC, because hash functions are unkeyed -- thus an attacker can always forge fake messages because they can calculate the digest of any message as easily as the legitimate parties.

With a MAC, such as CBC-MAC or HMAC, only the people who know the secret key can easily calculate the authentication 'Tag' for a given message, so if a message is sent accompanied by the correct Tag for that message then the receiver knows the message was almost certainly sent by someone who knew the key, and has not been altered (i.e. changed to a different message) in transit.

  • $\begingroup$ Thanks, I understand it better now. What if an attacker gets the key? He still can't really forge the signature, right? But he now can send a message, so there'd be no origin authenticity (if there were no CBC-MAC or HMAC), right? $\endgroup$ – evening Jan 7 '14 at 16:10
  • $\begingroup$ That's what forging is (i.e. sending a message of the attacker's choice with the correct Tag). If the attacker gets the key somehow then he can forge any message he likes. $\endgroup$ – J.D. Jan 7 '14 at 16:18
  • $\begingroup$ J.D. Yeah, okay, I meant he can't tamper with Alice's and Bob's messages they sent. $\endgroup$ – evening Jan 7 '14 at 16:21
  • 1
    $\begingroup$ @evening - you are correct, if the attacker gets the key at time T then he cannot tamper with messages sent and received prior to time T. Doing so would require both the key and a time machine. $\endgroup$ – J.D. Jan 7 '14 at 16:30
  • $\begingroup$ I am idiot. :D In this picture: upload.wikimedia.org/wikipedia/commons/thumb/b/bf/…, by E, they mean a hash function or a block cipher encryption function? $\endgroup$ – evening Jan 7 '14 at 17:07

Hash (message digest) and MAC (message authentication code) are a different thing.

CBC-MAC turns block cipher into MAC. HMAC turns hash function into MAC.

A good reason to use CBC-MAC would be that a MAC is needed and there is a suitable implementation of sufficiently secure block cipher available.

For instance, many of recent Intel-based processors have AES implemented in instruction set. Such hardware implementation is very fast, yet relatively secure.

CBC-MAC is mainly for fixed length messages

(Important note on using CBC-MAC.)

CBC-MAC is secure for fixed-length messages (or other prefix free messages). This is restriction which is occasionally overlooked by implementors and may result in significant security hole(s). There exists a newer cipher-based MAC, known as CMAC, which does not have this restriction. CMAC is introduced in NIST Special Publication 800-38B.

  • 1
    $\begingroup$ CBC-MAC is secure for prefix free messages. Fixed length is a sufficient condition, but not necessary. $\endgroup$ – CodesInChaos Jan 7 '14 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.