1
$\begingroup$

Can anyone explain to me why this is a bad idea? I cannot see anything wrong with it except that key K should be different for MAC and AES.

MAC algorithm consists of letting the MAC of message M (which consists of message blocks M1,M2,... ,Mn) be the AES encryption with key K of the XOR of all the message blocks.

i.e. MACK(M)=EK(M1 XOR M2 XOR ... XOR Mn)

$\endgroup$
2
$\begingroup$

It's trivial to calculate collisions because the message blocks M1..Mn can be interchanged without issue. So EK(M1 XOR M2) = EK(M1' XOR M2') where M1' = M2 and M2' = M1. Different messages should obviously not calculate to the same MAC authentication tag.

$\endgroup$
1
$\begingroup$

The problem is with XOR-ing the message blocks together to make a single compressed block. This reduces the message in a highly regular way, meaning it would be very easy to construct collisions. A length extension attack on this MAC design can consist of any data at all provided one of the blocks was the binary complement of the remainder - trivial to calculate.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.