Can anyone explain why CBC-MAC is not secure for variable length message?
I read many books, but there are still some confusion. Such as the highlighted parts in previous pictures
Questions:
Can anyone explain why CBC-MAC is not secure for variable length message?
For the previous question I'll quote Matthew Green's post from 2013:
A quick reminder. CBC-MAC is very similar to the classic CBC mode for encryption, with a few major differences. First, the Initialization Vector (IV) is a fixed value, usually zero. Second, CBC-MAC only outputs the last block of the ciphertext -- this single value forms the MAC.
Many dumb implementations stop here. And that leads to big problems.
Most notably, if your system allows for variable-length messages -- as it should -- there is a simple attack that allows you to forge new messages. First, get a MAC T on a message M1. Now XOR the tag T into the first block of some arbitrary second message M2, and get a MAC on the modified version of M2.
The resulting tag $T'$ turns out to be a valid MAC for the combined message $(M1 || M2)$. This is a valid forgery, and in some cases can actually be useful.
The standard fix to prepend the message length to the first block of the message before MACing it. But a surprisingly large number of (dumb) implementations skip this extra step. And many CBC-MAC implementations are dumb implementations.
(more info here)
First question, why need to set $T′′=C0$?
Actually it is not set. $T''$ is computed as written in the slide and the result is $C_0$.
Second question which is biggest question I don't understand, why $T′′′=T′′$. How to prove this relationship? Third question, why is $\text{new message}=P_0,P_1,(P_0⊕T′)$?
Let's compute the tag for $P'''$: after processing second bloc ($P_1$) one have $T'$, so when processing next bloc ($P_0 \oplus T'$) one computes the encryption of $T' \oplus P_0 \oplus T' = P_O$ that is, by definition, the tag of the second message: $T''$ ($P_0$ is the second message $P''$).
Roughly the idea is to add a bloc that cancel all previous computations and restart the CBC-MAC computation for a message which MAC is already know by the attacker. "Canceling" is done by xoring to the first added bloc the tag of the previous chain to the first bloc of an other message which MAC is known.
