4
$\begingroup$

As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea.

Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ensure CBC-MAC is resistant against length-extension attacks.

Now my simple question is:
Does this simple length prepending also fix the security vulnerability with re-using the key?

For clarity: The attack scenario is a standard CCA(2) scenario, the message length is feed into CBC-MAC but not CBC and there's no intent (by me) to use or even implement this.

From what I can tell, this "fix" should indeed fix the issue, because it relies on the ciphertexts being used for CBC-MAC and CBC to be the same (at the same positions) and so this sounds secure.

Improve this question
$\endgroup$
1
  • $\begingroup$ Did you compare it with the CMAC construct (which can be build from the CBC-MAC construct relatively easily)? Maybe you could reuse their security arguments. Or you could of course just use CMAC. It seems to me that the length in your example would be encoded using precisely the block size? $\endgroup$
    – Maarten Bodewes ♦
    Apr 11, 2016 at 21:48

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.