Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I have a message and I want to verify its integrity and authenticity.
I have a shared secret (key) that is not used for other encryption.
Is it safe to send a plaintext message containing all the data I want, and to verify its integrity and authenticity using CBC-MAC?
I mean - of course the data is not secret, but do I have a risk of someone changing the message / MAC and messing with my message? Is it possible to deduct the Key?
Yes, this is exactly what a message authentication code is for. Its job is to prevent an attacker from tampering with your message, or from forging completely bogus messages. For a secure MAC, it should not matter what these messages contain.
(And no, a secure MAC cannot compromise your key; if it did, it would by definition not be secure, since an attacker could use the key to forge messages.)
However, you probably don't want to use classic CBC-MAC if you can avoid it, since it's not provably secure when used on arbitrary messages. (It is secure when the messages are prefix-free, i.e. when no valid message can be a prefix of another valid message, but this can be somewhat tricky to ensure.) It's better to use CMAC or one of the other modern cipher-based MACs (OMAC2, PMAC, etc.) instead; unlike CBC-MAC, these have security proofs that don't require any special assumptions about the messages.
Also note that a MAC does not prevent an attacker from:
To protect against such attacks, you'll likely want to include an incremental message ID and/or a timestamp in your messages, as well as some way of identifying who sent the message and to whom. You also need to make sure that these extra fields are actually included as part of the MAC input, so that the attacker cannot change them.
Ps. When combining encryption with a MAC, the reason why we usually encrypt the message first is actually the opposite of what you may think: it's not meant to hide the plaintext from the MAC, but to protect the encryption scheme from chosen-ciphertext attacks by ensuring that only ciphertexts with a valid MAC are ever passed to the decryption code.
(Also, not all MACs are guaranteed to be privacy-preserving, which means that, if you calculate the MAC on the plaintext and then transmit the MAC output unencrypted, an attacker might theoretically learn something about the plaintext just by observing the MAC output. That said, most commonly used MACs — including CBC-MAC, when used properly — are privacy-preserving. And in any case, this doesn't matter for you, since you're transmitting the whole message unencrypted anyway.)
