# Forge CBC-MAC by creating a new message, given the MAC of two messages

The question is quite similar to this one : Forge CBC-MAC given the MAC of two messages and of their concatenation

But I still cannot fully understand it, and here's my question: given two messages with known MAC:
CBC-MAC(a||b)= x
CBC-MAC(d||e)= y

So from the given messages, I am able to forge a new message like this:
CBC-MAC(a || b || (d XOR x) || e ) = y (which is just like the post I read).

But how about if I want to forge the message like this:
CBC-MAC(a || b || c || d || e ) = z

The "c" maybe is something calculated from those two messages and its MAC, but I am not sure about it.

Is it possible to achieve this?

## 1 Answer

That doesn't look likely.

Given $\text{CBC-MAC}(d||e) = y$, we know that, saying at the initial IV state of $0$, then processing the blocks $d$ and $e$ gives us $y$; that doesn't say where we end up at any other starting state.

If $c$ was a single block, what we'd need to happen is to have it reset the state to 0 (and then the $d$ and $e$ would be processed as expected). That is, we would need to set $c$ so that $\text{Encrypt}_k( c \oplus x ) = 0$, or in other words, $c = x \oplus \text{Decrypt}_k(0)$.

That's where we get stuck; we can use $\text{CBC-MAC}$ as an encryption oracle (given a block $t$, what's $\text{Encrypt}_k(t)$?), but not as a decryption oracle; there's no query we can make that we tell us, given $t$, what's the value of $\text{Decrypt}_k(t)$.