Suppose I have Encryption in CTR-Mode and a CBC-MAC. Why should I also encrypt the MAC?

In the documentation of NIST stands: "By encrypting T we avoid CBC-MAC collision attacks".

But I can not imagine an attack based on an not-encrypted MAC. Can anyone give me an example of such an attack?


Let $M_k$ be CBC-MAC under the key $k$: for blocks $b_1, b_2, \dots, b_\ell$, $$M_k(b_1 \mathbin\| b_2 \mathbin\| \cdots \mathbin\| b_\ell) = E_k(\cdots E_k(E_k(b_1) \oplus b_2) \cdots \oplus b_\ell).$$

The message $m = m_1 \mathbin\| m_2$ collides with the message $m' = M_k(m_1) \oplus m_2$ under $M_k$, since

\begin{align} M_k(m_1) &= E_k(m_1), \\ M_k(m_1 \mathbin\| m_2) &= E_k(E_k(m_1) \oplus m_2), \\ M_k(M_k(m_1) \oplus m_2) &= M_k(E_k(m_1) \oplus m_2) = E_k(E_k(m_1) \oplus m_2). \end{align}

If the CCM ciphertext for $m_1$ revealed $M_k(m_1)$, then an adversary could use that and the CCM ciphertext for $m$ to forge the CCM ciphertext for $m'$ since the CTR encryption preserves $\oplus$. To thwart this, CCM encrypts the authentication tag too, with an additional block in the one-time pad generated by CTR.


Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.