14
$\begingroup$

In the setting of Encrypt-then-MAC, do I need to include the IV in what I'm HMACing, or is authenticating just the AES-encrypted data sufficient?

Improve this question
$\endgroup$
1
  • $\begingroup$ Note that with authenticate modes of encryption (AEAD modes) such as GCM which should be used instead of proprietary encrypt-then-MAC schemes if possible the IV is always included in the calculation of the authentication tag. $\endgroup$
    – Maarten Bodewes ♦
    Commented Nov 20, 2017 at 10:06

2 Answers 2

Reset to default
25
$\begingroup$

In short: You must authenticate the IV. Which particular attacks apply if you don't depends on the block cipher mode; I will give two common examples.

  • In CTR mode, an attacker who fiddles with the IV can forge authenticated messages, but the content of the corresponding plaintext is beyond his control (since he doesn't know the key). Depending on the encrypted data, this may or may not be a real problem (as random binary garbage may be caught by subsequent validations in the protocol), but it certainly is an unnecessary security risk in any case.

  • CBC mode breaks horribly, as the following diagram shows: CBC mode decryption Clearly, the IV is exclusively XORed into the first plaintext block after decryption and discarded afterwards, enabling an attacker to introduce arbitrary differentials in the first block without changing anything else by XORing them into the IV. Depending on the payload's structure, this could, for example, be used to toggle some important flag in a protocol header or change a length field.

Improve this answer
$\endgroup$
5
$\begingroup$

The Encrypt then MAC is done in general in order to be sure to decrypt into the correct plaintext, without risking of parsing a non-authentic plaintext message.

If you don't MAC the IV, then Mallory (attacker that can tamper with messages as a man-in-the-middle) can modify the IV and your MAC will be still validated as good.

So you will decrypt into an something different than the message, because the change in the IV will change the decrypted text.

If, instead, you HMAC also IV then you avoid the issue.

Therefore it is not safe to not process the IV during the HMAC computation.

EDIT: due to valuable comments by D.W. and poncho

Improve this answer
$\endgroup$
3
  • 2
    $\begingroup$ Correction: assuming we're talking about CBC mode, Mallory can predict the result of the modification; if he flips bit $i$ of the IV, this will result in flipping bit $i$ of the decrypted text. What this means is that if Mallory knows the first 128 bits of the correct decrypted message, he can replace that with any other 128 bit value of his choosing. $\endgroup$
    – poncho
    Commented Mar 11, 2015 at 13:58
  • 1
    $\begingroup$ This answer contains incorrect statement. 1. It's not just "safer" to MAC the IV; it's unsafe if you don't MAC the IV. 2. "although Mallory can't predict the result of the decryption in any way" - This is simply false. Moreover, I don't know what you mean by "an invalid message", but there's no guarantee that the decryption will be "invalid"; it might be a completely valid message that just happens to be something other than what the sender wanted to send (which would amount to a break of integrity). $\endgroup$
    – D.W.
    Commented Mar 11, 2015 at 20:57
  • $\begingroup$ I totally agree with you both, edited. $\endgroup$
    – Ruggero
    Commented Mar 11, 2015 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.