Let $(Mac, Vrfy)$ be a safe defined $MAC$ over $(K,M,T)$ where $ M = \{0,1\}^n$ and $T = \{0,1\}^{128}$.
Is the following $MAC$ safe? Show your proof.

$Mac'(k,m) = Mac(k, m)$
$Vrfy'(k,m,t) = \{Vrfy(k,m, t), $ if $m≠1^n;1, $ otherwise$\}$

My proof is as follows:
I take an example message $m = 01$ and query an oracle for the $T$ corresponding tag. And then I take another message $m' = 11$ and immediately see that $Vrfy'(k,11,T) = 1$ with the previous $T$ obtained tag, therefore I obtained true with a message that I did not query an oracle for it's tag, therefore it is not safe.

Is my proof correct and complete or am I completely missing the point?

Thank you for the help.

  • 2
    $\begingroup$ Smells OK to me. I'm not sure you'd need the Oracle at all since you can make up any tag for a message consisting of $1^n$. Maybe you could just define a message 0 meaning false and a message 1 meaning true. Now an attacker can always replace an authenticated message 0 with message 1 (as the authentication tag of the latter message is never checked). $\endgroup$ – Maarten Bodewes Jun 7 '16 at 20:28
  • $\begingroup$ @MaartenBodewes thank you for the help, I really appreciate it :) $\endgroup$ – southpaw22 Jun 7 '16 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.