I've just read about CBC-MAC for the authentication of arbitrary length messages. In particular I cannot figure out why appending the message length before computing the MAC yields a non-secure MAC. I've already read other topics on crypto about this problem, but i did not find a rigorous proof.
$\begingroup$
$\endgroup$
-
1$\begingroup$ I attempted to clarify your question, please fix if I messed it up. Does this not answer your question: crypto.stackexchange.com/a/11152/13625 $\endgroup$ – otus Jan 11 '16 at 9:49
$\begingroup$
$\endgroup$
I'll give you a hint, and you can work out the details yourself.
Take any $m_1,m_2,m_3$ of length $n$ (where $n$ is the block length), with $m_1\neq m_2$. Query the oracle with $m_1$, then query the oracle with $m_2$, and finally query the oracle with $m_1\|n\|m_3$.
Work through this, and you can find a message and its forgery.
answered Jan 11 '16 at 14:48
