1
$\begingroup$

If a variable length CBC-MAC is used with a block cipher (a.k.a. pseudorandom permutation), does there exist a block cipher such that implementation of this CBC-MAC may be used as a cryptographic hash function, provided that k is fixed?

$\endgroup$
  • $\begingroup$ block cipher indicates that this transformation is fixed length... I'll let you figure out rest. $\endgroup$ – axapaxa Jul 14 '17 at 1:40
  • $\begingroup$ The question has been edited to comply with a variable length input $\endgroup$ – gibarsin Jul 14 '17 at 1:51
1
$\begingroup$

No, it cannot; you can find a preimage attack on it.

CBC-MAC on a two-block message $(M_0, M_1)$ (after padding) is defined as $E_k( M_1 \oplus E_k( M_0 ))$. To find a preimage for a value $S$, you select $M_1$ with a valid padding pattern (because of the padding, we cannot select this block arbitrarily), and compute $M_0 = D_k(M_1 \oplus D_k(S))$; it is easy to see that the padding message $(M_0, M_1)$ hashes to the value $S$.

And, even if you cannot easily compute $D_k$, it is still easy to find second preimages...

$\endgroup$
  • $\begingroup$ I do not understand why the application of CBC-MAC is shown as an encryption function E_k and why would a D_k function exist. Do you mean by this that both functions correspond to the block cipher? $\endgroup$ – gibarsin Jul 14 '17 at 12:24
  • $\begingroup$ @gibarsin: if $E_k$ is the application of the block cipher (in the encrypt direction; that is, if $B$ is the input block, then $E_k(B)$ is the value of the output block), then $E_k( M_1 \oplus E_k( M_0 ))$ is what is computed when doing CBC-MAC on a 2 block message (ignoring padding), and $D_k$ is the block cipher in the decrypt direction. $\endgroup$ – poncho Jul 14 '17 at 13:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.