The question is quite similar to this one : Forge CBC-MAC given the MAC of two messages and of their concatenation

But I still cannot fully understand it, and here's my question: given two messages with known MAC:
CBC-MAC(a||b)= x
CBC-MAC(d||e)= y

So from the given messages, I am able to forge a new message like this:
CBC-MAC(a || b || (d XOR x) || e ) = y (which is just like the post I read).

But how about if I want to forge the message like this:
CBC-MAC(a || b || c || d || e ) = z

The "c" maybe is something calculated from those two messages and its MAC, but I am not sure about it.

Is it possible to achieve this?


1 Answer 1


That doesn't look likely.

Given $\text{CBC-MAC}(d||e) = y$, we know that, saying at the initial IV state of $0$, then processing the blocks $d$ and $e$ gives us $y$; that doesn't say where we end up at any other starting state.

If $c$ was a single block, what we'd need to happen is to have it reset the state to 0 (and then the $d$ and $e$ would be processed as expected). That is, we would need to set $c$ so that $\text{Encrypt}_k( c \oplus x ) = 0$, or in other words, $c = x \oplus \text{Decrypt}_k(0)$.

That's where we get stuck; we can use $\text{CBC-MAC}$ as an encryption oracle (given a block $t$, what's $\text{Encrypt}_k(t)$?), but not as a decryption oracle; there's no query we can make that we tell us, given $t$, what's the value of $\text{Decrypt}_k(t)$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.