7
$\begingroup$

I can find descriptions of using CFB mode to create a MAC and even implementations, but cannot find any standard or papers analyzing its security bounds.

Is there a standard for CFB-MAC?

Where can I find an analysis of its security bounds?

$\endgroup$
  • 1
    $\begingroup$ I've never seen it used. Some searching shows a few VIA chips have it as a mode, but no actual applications of that mode. $\endgroup$ – SAI Peregrinus Aug 29 '15 at 22:57
  • $\begingroup$ @SAIPeregrinus, Bouncy Castle has a CFBBlockCipherMac. $\endgroup$ – otus Aug 30 '15 at 6:44
  • $\begingroup$ Hmm, I wonder if it has the same issues as CBC-MAC... $\endgroup$ – Maarten Bodewes Aug 30 '15 at 11:13
  • 3
    $\begingroup$ I could only find this paper (on eprint) mentioning CFB-MAC in the way: "you can apply our attack to CFB-MAC as well". They cite ANSI X9.9 as source for CFB-MAC meaning its somewhat standardized. $\endgroup$ – SEJPM Aug 30 '15 at 19:35
  • $\begingroup$ One thing you should not forget is that for CBC-MAC the IV must not be predictable, while for CFB-MAC IV can be predictable. See: en.wikipedia.org/wiki/… $\endgroup$ – FaST4 Feb 11 '16 at 15:50
4
$\begingroup$

According to Handbook of Applied Cryptography (15.3.2, ii), ANSI X9.9 (which SEJPM mentioned in the comments but I have no access to) defined CFB-MAC only as a compatible alternative to CBC-MAC:

The X9.9 MAC algorithm may be implemented using either the cipher-block chaining (CBC) or 64-bit cipher feedback (CFB-64) mode, initialized to produce the same result (see Note 15.1).

With a segment size equal to the block size (so 64 bits with DES) and using the first message block as IV, the two are indeed equivalent. So this case of CFB-MAC clearly has all the properties of CBC-MAC.


However, the first definition of CFB MAC seems to be from FIPS 81 (DES Modes of Operation, see Appendix F):

A MAC may be generated using either the CBC or the CFB mode. [...]

In CFB authentication, a message is encrypted in the normal CFB manner except that the cipher text is discarded. After encrypting the final Kbits of data and feeding the resulting cipher text back into the DES inputblock, the DES device is operated one more time and the most significant M bits of the resulting DES output block are used as the MAC.

The example shows 8-bit CFB MAC using an IV, so clearly it was defined for arbitrary CFB modes.


What remains unanswered is how the security compares to that of CBC-MAC when segment size differs from the block size. However, the use of segments is somewhat historical anyway, so it is only a curiosity.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.