I'm trying to solve a problem that was given to me. The issue I have is that I'm missing some parts to solve it.
I'm confronted with an Oracle that performs MAC on an input that can be of any length using the following function. I need to forge a message that must match the message the Oracle has computed.
$o_1 = E(k, d_1)$
$o_2 = E(k, o_1 \oplus d_2)$
...
$o_N = E(k, o_{N-1} \oplus d_N)$
therefore $MAC(k, d) = o_1 \oplus o_2 \oplus ... \oplus o_N$
where $d_X$ are block size parts of the message (ex.: message is 32 bit long = 4 x 8-bit blocks).
In order to forge the message, the Oracle offers 2 methods:
$mac0(n)$ -> performs $MAC(k,msg)$ with msg = n x d (where d is a 8-bit block full of zeros and n is the number of block asked)
$mac3(input)$ -> performs $MAC(k, d)$ with any input (if the input is bigger than 3 blocks, it truncates it to 3 block; if smaller, it pads the remaining parts with zeros until the input is 3 blocks long).
In the case of the example I'll use an 32-bit long input (4 blocks).
The first thing that I currently do is that I use mac3 with the first blocks which will result in $o_3$. I, then, XOR $o_3$ with the last block ($d_4$) and send the result through $mac3$ again. When comparing with the actual result from the Oracle, I find that it is not equal.
So that's where I'm stuck.. According to what I understood, this might be due to the padding done by $mac3$ since the input is not 3 block long. This is the part I don't know how to solve. Would there be a way to revert the result to find the actual forged message?
Any other ideas?