If a message $M$ contains $n$ message blocks and I XOR the message blocks and encrypt the result using AES, can i use the resulting cipher-text as MAC? is it a good design or bad one?


2 Answers 2


TL;DR: It is a bad one.


Consider a message $m$ such that $m = M_1 || M_2 || \ldots || M_n$ where $||$ is the concatenation and $M_{1..n}$ are of the same size (typically here 128 bits) and let your MAC be
$$ \begin{align} MAC(M) &= AES( M_1 \oplus M_2 \oplus \ldots \oplus M_n)\\&= AES(\bigoplus_{i=1}^n M_i) \end{align}$$.

We have a forgery if we can find $M$ and $M'$ such that $MAC(M) = MAC(M')$.

Consider: $$M \;= M_1 || M_2 || \ldots || M_n$$ and $$M' = M'_1 || M'_2 || \ldots || M_n$$ where $M'_1 = M_1 \oplus 1$ and $M'_2 = M_2 \oplus 1$

Thus: $$ \begin{align} MAC(M') &= AES( M_1 \oplus 1 \oplus M_2 \oplus 1 \oplus \ldots \oplus M_n)\\ &= AES( M_1 \oplus M_2 \oplus \ldots \oplus M_n)\\ &= MAC(M) \end{align}$$

With this I created a forgery $M'$ of $M$ which would still have the same MAC. $\square$


You don't even need the key used for the AES encryption to create the forgery.


This is not a secure MAC. For example, when this is used to authenticate an unencrypted string (which is something a secure MAC should be capable of), it is trivial to craft a message of which the XOR of all the blocks is the same as for legitimate message (that XOR value by itself, for example). In that case, the legitimate 'MAC' can be attached to the crafted message and the validation will succeed.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.