There are a number of message authentication codes (MACs) used in practice. They are highly used in practice (f.ex. in TLS), but there's (at least) one application where they can't be used: Full Disk Encryption (FDE).
Now most FDE applications just don't bother with authentication. TrueCrypt for example has no authentication mechanism in place for authenticating the bulk data. However it uses CRC-32 (!) to ensure integrity of the data encryption keys in the header. The advantage this provides is that the ciphertext may be completely indistuingishable from random.
Now I want to create a data container format with the same property (complete file is random-looking) but want to perform strong authentication of the data encryption keys. This means I need to use authenticated encryption (AE).
Most of the AE schemes append a tag to the ciphertext and to ensure pseudorandomness of the whole file this tag also has to be random looking. The desired notion for this would be IND-CPA.
So my question:
Are the output tags of the common MACs / AE-modes indistinguishable from random data under chosen plaintext (or eavesdropper?) attacks?
What is considered common MACs / AE-modes:
- GCM
- EAX
- CWC
- HMAC
- CMAC / CCM