# Why can't we use the first block of AES-CBC as MAC

As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?

• Note that CBC-MAC is not secure for dynamically sized input, you'd have to use CMAC for that (which actually uses CBC-MAC underneath). – Maarten Bodewes Apr 16 '16 at 9:18

The MAC value should be calculated over all of the input, not just the first block. The chaining of CBC makes sure that the bits in the last block of ciphertext depends on all the previous blocks. It's also worth considering the point of a MAC in the first place, i.e. - why it should be calculated over all of the input rather than just the first block. Making the tag dependent on only the first block of the tag would allow an attacker to fill in the rest of the message with whatever they wanted, so long as the first block of CT represented a valid tag.

More specifically, consider a chosen message attack scenario where an attacker had some $$(IV, M, T)$$ with $M = M_1M_2M_3$. If the $IV$ was not constant, the attacker could construct another tuple $$(IV', M', T')$$ with the property that:

$$IV' \oplus M_1' = IV \oplus M_1$$

Then, $M_2'$ and $M_3'$ could literally be anything at all and the tag would remain valid $(T = T')$.

If, however, the $IV$ was constant (which it should be in practice), the attacker could just keep $M_1$ the same, so $M' = M_1M_2'M_3'$, and the tag would still be valid.