1
$\begingroup$

I searched the answer but I'm not sure if I understood exactly, and have some other questions.

  1. I understood that the reason for CBC-MAC not to have random IV is if CBC-MAC has a random IV, the attacker can change the P1 block, making the tag arbitrary, so the CBC-MAC scheme can be insecure. Am I right?

    1-1. Attacker can make the tag arbitrary not depending on the IV because of the property of encryption blocks. Then why we should not use IV or should use all-zero IV?

  2. If we use random IV, then a sender and receiver must share a IV before the receiver receives the tag and it is inefficient, so we don't have to use random IV. Did I understand right?

  3. Are there any other attacks that can made if we use random IV?

$\endgroup$
3
  • $\begingroup$ I don't know what you mean with "the property of the encryption blocks". Please explain this, possibly using a picture or a formal specification. $\endgroup$
    – Maarten Bodewes
    Nov 6, 2016 at 10:58
  • $\begingroup$ What's wrong with the obvious: a MAC is a function of key and message, and there's no room for an IV in these two; thus if CBC-MAC is a MAC, as implied by the name, it has no IV? $\endgroup$
    – fgrieu
    Nov 6, 2016 at 14:32
  • $\begingroup$ I'm not English speaker and not good at vocabulary... Sorry. $\endgroup$
    – CYDF
    Nov 7, 2016 at 7:00

1 Answer 1

1
$\begingroup$
  1. I understood that the reason for CBC-MAC not to have random IV is if CBC-MAC has a random IV, the attacker can change the P1 block, making the tag arbitrary, so the CBC-MAC scheme can be insecure. Am I right?

If you assume that the attacker can know the first block of the message and can control the IV then it is easy to see that you can create an identical authentication tag for multiple IV / initial message block pairs. If the input of the first block encrypt and the following blocks are identical, then the authentication tag will repeat.

This won't work for the other blocks as the cipher will change the bits of the next vector independently of the change. An attacker doesn't gain much by being able to change 50% of the of the input of the cipher randomly.

1-1. Attacker can make the tag arbitrary not depending on the IV because of the property of encryption blocks. Then why we should not use IV or should use all-zero IV?

I don't think the statement in the first sentence of the question is correct. The attacker should not be able to create a valid authentication tag, because the attacker does not know/control the key.

It's however unclear what you mean with encryption block property.


If we use random IV, then a sender and receiver must share a IV before the receiver receives the tag and it is inefficient, so we don't have to use random IV. Did I understand right?

No. For CBC encryption the IV needs to be unpredictable to the attacker. There are however schemes such as encrypting a counter to generate an unpredictable IV without actually including it with the ciphertext.

As indicated, we don't use a random IV for CBC-MAC. CBC-MAC relies on CBC mode of operation but it doesn't use it for providing confidentiality. So the security requirements of the IV being unpredictable are not applicable to CBC-MAC.


Are there any other attacks that can made if we use random IV?

I don't directly seen any.

After completely loosing integrity / authentication of a full block of the message, I guess we don't need any others.


Notes:

  • CBC requires an IV, so lets call this an all-zero IV (any other constant IV would have the same result, a zero IV is just easier to implement);
  • beware that CBC-MAC should only be used for messages with known-length and preferably a 128 bit (or higher) block cipher, use CMAC, HMAC or an authenticated cipher instead.
$\endgroup$
2
  • $\begingroup$ Does CBC means CBC-MAC in this writing? I'm not concerned with CBC mode. $\endgroup$
    – CYDF
    Nov 7, 2016 at 7:09
  • $\begingroup$ I think I made a clear distinction between CBC encryption and CBC-MAC in my answer. Please indicate which part is unclear to you. $\endgroup$
    – Maarten Bodewes
    Nov 7, 2016 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.