Would using the ciphertext of the previous block as key instead of XOR:ing the block and encrypting with the normal key work?

Normally it's done like this:

Normal CBC-MAC

What if we instead do this:

enter image description here

Seems like it should be more or less the same thing in the end?


I'll assume that you a prefix-free encoding (or fixed-length messages) to solve that problem of CBC-MAC. It's actually very possible that this would be secure since the proof of CBC-MAC pretty much works by showing that the input to each block is random. Thus, it's conceivable that it will be secure when using the result as a key (since it's also random). However, I say just "conceivable" because you would have to formally prove this.

I'll just note that in practice this would be a terrible idea since it would require a new key schedule for every block. That would be really inefficient (e.g., for AES).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.