# Why are there no MACs inspired by block cipher modes other than CBC and CFB?

I've been studying message authentication codes and I was wondering why a MAC can only be produced with AES in CBC and CFB mode and why not the other modes such as ECB, OFB and counter.

Why are CBC and CFB suitable modes to produce MACs? Is there a certain trait that makes them special when compared to the other modes?

• What makes you think that MACs "can only be produced in CBC and CFB mode"? $\hspace{1.48 in}$ – user991 Jan 3 '15 at 22:36
• I meant why CBC and CFB but not in other modes such as OFB, ECB and counter – Student101 Jan 3 '15 at 22:38
• Please clarify your question, especially the statement quoted by Ricky. None of the traditional cipher modes (ECB, CBC, CFB, OFB and CTR) include a MAC, nor can they be (directly) used as one. There are MAC constructions that do bear some resemblance to these modes, such as CBC-MAC and its modern replacement CMAC, but those are separate constructions (although CBC and CBC-MAC do work very similarly). (Also, MAC usually stands for message authentication code; if you really mean mutual, please clarify that too.) – Ilmari Karonen Jan 3 '15 at 23:11
• Ok let me clarify the question. I'm studying AES and MESSAGE authentication code. Sorry spotted the mistake above. I was wondering why CBC and CFB are suitable modes to produce MACs compared to other modes. Is there a certain trait that makes them special when compared to the other modes. – Student101 Jan 3 '15 at 23:16
• Your clarification only seems to have furthered the misunderstanding. – Stephen Touset Jan 4 '15 at 3:08

It is certainly wrong to state that "MAC can only be produced with AES in CBC and CFB mode", but there seems to be a simple reason that people were inspired by these modes when thinking up possible MAC constructions: They carry along some state that incorporates information from the message while traversing the input blocks. In both modes, encrypting a block involves taking the current state along with a message block and transforming them in some way to obtain a ciphertext block and an updated state. This is not the case with the other common block cipher modes.

• ECB is completely stateless.
• Counter mode (CTR) has some state (namely, the counter), but it is independent of the message and therefore useless to assert message integrity.
• Output feedback mode (OFB) is also stateful, but the message is XORed into the to-be ciphertext block after the fed-back block has been tapped. Therefore, the state is independent of the message, just like for counter mode.