The question is quite similar to this one : Forge CBC-MAC given the MAC of two messages and of their concatenation

But i still cannot fully understand it, and here's my question: giving two messages with known MAC:
CBC-MAC(a||b)= x
CBC-MAC(d||e)= y

So from the given message, i am able to forge a new message like this:
CBC-MAC(a || b || (d XOR x) || e ) = y which just like the post i read.

But how about if i want to forge the message like this:
CBC-MAC(a || b || c || d || e ) = z

The "c" maybe something calculated from those two message and its MAC, I am not sure about it.

Is it possible to achieve this?

up vote 0 down vote accepted

That doesn't look likely.

Given $\text{CBC-MAC}(d||e) = y$, we know that, saying at the initial IV state of $0$, then processing the blocks $d$ and $e$ gives us $y$; that doesn't say where we end up at any other starting state.

If $c$ was a single block, what we'd need to happen is to have it reset the state to 0 (and then the $d$ and $e$ would be processed as expected). That is, we would need to set $c$ so that $\text{Encrypt}_k( c \oplus x ) = 0$, or in other words, $c = x \oplus \text{Decrypt}_k(0)$.

That's where we get stuck; we can use $\text{CBC-MAC}$ as an encryption oracle (given a block $t$, what's $\text{Encrypt}_k(t)$?), but not as a decryption oracle; there's no query we can make that we tell us, given $t$, what's the value of $\text{Decrypt}_k(t)$.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.