4
$\begingroup$

XCBC paper says all three keys should be independent. It doesn't say they must always be different. However it seems this is necessary to differentiate padded message and message without padding.

Lets say we derive all three keys so that key 2 and key 3 might be the identical (randomly). Is it secure?

$\endgroup$
  • 2
    $\begingroup$ I guess the referenced paper is John Black and Phillip Rogaway's CBC MACs for Arbitrary-Length Messages: The Three-Key Constructions (in proceedings of Crypto 2000, or 2003 version). $\;$ If we draw key randomly, the system is secure, because keys 2 and 3 are identical with infinitesimal odds. I think a more practically interesting question is: Is the system secure if we derive two keys K1 and K2 randomly, and set K3=K2. $\endgroup$ – fgrieu Nov 3 '14 at 18:12
  • 2
    $\begingroup$ Being the same key is like the overlord of being dependant on each other. $\endgroup$ – Nova Nov 3 '14 at 19:47
  • $\begingroup$ I agree with fgrieu but I'll try and put it more succinctly: if the keys are independent, they should be different. $\endgroup$ – Maarten Bodewes Nov 6 '14 at 1:45
5
$\begingroup$

If key 2 and key 3 has a nonnegligible chance to be the same, then the attacker has a nonnegligible chance of being able to generate a valid (Message, MAC) pair.

Here's how it works, if the message is not a multiple of 16, then XCBC pads the message out to the next multiple of 16; if it already is, the message remains the same.

Then, XCBC logically does a CBC mode encryption (using key 1); except that when it gets to the last block, it xor's in either K2 (if no padding was added) or K3 (if padding was added) before the final encryption.

Note that this padding operation is public; anyone can compute it.

What the attacker would do is request the MAC of a message M (which is not a multiple of 16); he gets a valid T.

Then, the pair (Pad(M), T) has a nonnegligible chance of being also valid; if K2==K3, then the message will be a multiple of 16, and so no padding is added; XCBC will xor in K2, but since K2==K3, that'll give the same result as the corresponding step during the query, and the final encryption will also be the same.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.