Assume we have a hardware device with build-in AES decryption and support for ECB and CBC mode (but no support for AES encryption). It only receives data and decrypts it. Minor modifications of the hardware are still possible, but you can't add AES encryption.

Now assume we want to add a MAC for ensuring integrity. CBC-MAC can't be used, as it requires the encryption mode of the block cipher.

Are there MACs you can construct with only the decryption mode of a block cipher?

I thought about using the CBC-MAC scheme and simply replace the AES encryption with the AES decryption, but I'm not sure this would result in a secure MAC.


1 Answer 1


A block cipher is a (strong) pseudorandom permutation. As such, it makes no difference if you compute it in the forward or in the backward direction. Thus, you can use AES in decryption mode and it has exactly the same security as AES in encryption mode, as a block cipher. Therefore, you can do CBC-MAC with AES decryption and you are fine.

Two remarks:

  1. Make sure you use an independent key for the CBC-MAC (and not the same as the encryption), and
  2. You should use CMAC and not straight CBC-MAC.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.