# CBC-MAC based on PRF

Why is the block cipher in the CBC-MAC taken to be a pseudo random permutation (PRP) and not a pseudo random function (PRF)? We don't need the bijective property of the PRP. So why go with it?

• Why not? Most of the time a PRP is faster, and it is nice if you can use the same primitive for both confidentiality and integrity/authenticity (e.g. CCM & EAX mode of encryption). – Maarten Bodewes Sep 1 '14 at 17:37
• Did a bit of research, but this algorithm goes back to FIPS 113 (1985), and that "standard" does not do too much reasoning. OMAC and CMAC papers don't list the reason either. So the best answer may be that it uses a PRP because if it was a PRF, it would be a HMAC :P – Maarten Bodewes Sep 1 '14 at 18:07
• @owlstead, i don't agree that a secure PRP is always faster than a secure PRF. We can make PRFs out of PRGs such as SALSA20 which is fast. Check out cryptopp.com/benchmarks.html – BlaX Sep 1 '14 at 22:09
• OK, maybe "most of the time" is taking it a bit far. The fact that you can use the same primitive as for confidentiality certainly is a feature though. Note that you could of course also use a stream cipher and a derived HMAC for confidentiality. See for instance the Spritz paper. – Maarten Bodewes Sep 2 '14 at 11:18

From the security point of view there will be no difference: the security proof for the CBC-MAC first converts PRP to PRF (which is indistinguishable up to $2^{n/2}$ queries) and then derives an actual upper bound on the adversary's advantage.