I'm trying to implement AES CBC MAC splicing attack in Python, the idea is:

given a message M, its tag Tm (MAC(M) = T), a new message N and its tag Tn we build a message such as: M||N = (M1, ..., Mn, N1 ⊕ Tn, N2, ..., Nn) that has the same tag with N (that is because you inserted a block which resets the algorithm).

The idea is quite clear, but I still cannot get the correct tag.

Here is my code (I'm new to Python, sorry):

from Crypto.Cipher import AES
from Crypto.Util.strxor import strxor
from binascii import hexlify
import argparse
import pickle

BLOCK_SIZE = AES.block_size

def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("f1", type=str, help="f1")
    parser.add_argument("f2", type=str, help="f2")
    parser.add_argument("tag1", type=str, help="tag1")
    parser.add_argument("tag2", type=str, help="tag2")
    parser.add_argument("k", type=str, help="key")
    args = parser.parse_args()
    with open(args.tag2, "rb") as tag2:
        stored_tag = pickle.load(tag2)
    with open(args.k, mode="rb") as f:
        key = pickle.load(f)
    assert len(key) == AES_KEY_SIZE
    cipher = AES.new(key, AES.MODE_CBC, b'\0' * BLOCK_SIZE)
    with open(args.f2, mode="rb") as f2:
        f2_block1 = f2.read(BLOCK_SIZE)
        b1 = cipher.encrypt(strxor(f2_block1, stored_tag))
        with open(args.f1, mode="rb") as f1:
            file1 = f1.read()
        file2 = f2.read()
        the_rest_of_the_file = file2[BLOCK_SIZE:len(file2)]
        new = open('newfile.file','w')
        s = file1 + b1 + the_rest_of_the_file

if __name__=="__main__":
  • 2
    $\begingroup$ I've tried to answer your question, since ironically the error appears to be in your cryptography rather than your python. In general, questions here shouldn't involve large amounts of code, since the aim should be the study of cryptography as a theoretical science, rather than programming $\endgroup$ Mar 26, 2014 at 13:33
  • $\begingroup$ @figlesquidge Good catch! Guess this is one of the rare cases that proves questions with code can be on-topic… oh, the irony – always good enough to make me smile on a rainy day. ;) $\endgroup$
    – e-sushi
    Mar 26, 2014 at 16:16

1 Answer 1


Just for completeness sake, CBC is defined as follows: CBC mode

The error you have made is that:

$$M;N = (M_1, ..., M_n, N_1 ⊕ \mathbf{T_m}, N_2, ..., N_n)$$ (I've changed notation from M||N to M;N to reflect this isn't just concatenation)

You need to cancel the tag from the message $M$, not the tag from the $N$ message. In that case, $T_{M;N}=T_N$ as required.

  • $\begingroup$ Don't forget to mark it as closed then! :) $\endgroup$ Apr 1, 2014 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.