As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?

  • Note that CBC-MAC is not secure for dynamically sized input, you'd have to use CMAC for that (which actually uses CBC-MAC underneath). – Maarten Bodewes Apr 16 '16 at 9:18
up vote 13 down vote accepted

The MAC value should be calculated over all of the input, not just the first block. The chaining of CBC makes sure that the bits in the last block of ciphertext depends on all the previous blocks.

enter image description here

It's also worth considering the point of a MAC in the first place, i.e. - why it should be calculated over all of the input rather than just the first block. Making the tag dependent on only the first block of the tag would allow an attacker to fill in the rest of the message with whatever they wanted, so long as the first block of CT represented a valid tag.

More specifically, consider a chosen message attack scenario where an attacker had some $$(IV, M, T)$$ with $M = M_1M_2M_3$. If the $IV$ was not constant, the attacker could construct another tuple $$(IV', M', T')$$ with the property that:

$$IV' \oplus M_1' = IV \oplus M_1$$

Then, $M_2'$ and $M_3'$ could literally be anything at all and the tag would remain valid $(T = T')$.

If, however, the $IV$ was constant (which it should be in practice), the attacker could just keep $M_1$ the same, so $M' = M_1M_2'M_3'$, and the tag would still be valid.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.