Lets say that we use init vector IV, key K and HMAC key H. Message is M.

Mode of operation is CBC !!!

We usually encrypt this way:

C = crypt(M,K,IV) #encrypted data  
R = C + MAC(C)  # final result and + is for con cat

But we could just use:

R = len + crypt(M + H,K, IV)  # notice M + H

Is there something wrong with such a scheme? It looks much faster to me and requires like half the computation and complexity.

  • $\begingroup$ Yes, it does not give message authenticity and it leaves crypt accessible to chosen-ciphertext attacks. $\endgroup$ – user991 Jul 30 '12 at 10:48
  • $\begingroup$ If HMAC is too slow for you, I'd look into authenticated encryption modes. They use much faster MAC techniques. $\endgroup$ – CodesInChaos Jul 30 '12 at 11:36

This scheme is totally insecure. If an attacker modifies any part of the ciphertext except the last block before the ciphertext corresponding to H, your scheme won't catch it.

CBC decryption of a block only depends on the ciphertext of the previous and current block.Illustration

(Based on Cbc decryption.png from Wikipedia)

The red parts are left totally unprotected by your MAC scheme. The green parts affect your MAC, but even on them there are some attacks.

| improve this answer | |
  • $\begingroup$ Oh, I see, what about replacing whit some other mode. That propagates trough all $\endgroup$ – ralu Jul 30 '12 at 11:31
  • $\begingroup$ That depends on the exact mode. $\endgroup$ – CodesInChaos Jul 30 '12 at 11:36
  • $\begingroup$ Crazy, I just had a similar thought earlier today after getting pissed off at HMAC, but using CFB instead. I came to the same conclusion after a few minutes, the diagram illustrates it all very neatly, +1. $\endgroup$ – Thomas Jul 30 '12 at 13:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.