# Is XCBC where k2 and k3 might be the identical, secure?

XCBC paper says all three keys should be independent. It doesn't say they must always be different. However it seems this is necessary to differentiate padded message and message without padding.

Lets say we derive all three keys so that key 2 and key 3 might be the identical (randomly). Is it secure?

• I guess the referenced paper is John Black and Phillip Rogaway's CBC MACs for Arbitrary-Length Messages: The Three-Key Constructions (in proceedings of Crypto 2000, or 2003 version). $\;$ If we draw key randomly, the system is secure, because keys 2 and 3 are identical with infinitesimal odds. I think a more practically interesting question is: Is the system secure if we derive two keys K1 and K2 randomly, and set K3=K2. – fgrieu Nov 3 '14 at 18:12
• Being the same key is like the overlord of being dependant on each other. – Nova Nov 3 '14 at 19:47
• I agree with fgrieu but I'll try and put it more succinctly: if the keys are independent, they should be different. – Maarten Bodewes Nov 6 '14 at 1:45