I see everywhere that fixed length CBC-MAC should be more or less secure against forgery. But is it really ?

Could you forge a message assuming by example that you use CBC-MAC with let's say always 100 blocks (if it is less than 100 you pad with 0 until it reaches 100 block, so you can authenticate message from 0 to 100*block length bits) if you have access to an oracle?

You don't know the key(it is fixed), the IV is fixed to 0 and the Oracle only returns the MAC.

  • $\begingroup$ You'll need to be more specific about the exact nature of the protocol and of a forgery. If you're wondering about whether with an oracle that will zero-pad a message up to 100 blocks you can forge a tag on a message that ends in zeros, the answer is obviously yes, you can forge such a tag, because the padding scheme confuses messages that end in zeros with messages that don't end in zeros, through no fault of CBC-MAC. $\endgroup$ – Squeamish Ossifrage Dec 18 '17 at 16:09

Let's simplify this to one-block messages with a 128-bit block. Your scheme to authenticate a message whose length in bits $n$ is anywhere from 0 to 128 is $$\operatorname{MAC}_k(m) = \operatorname{AES}_k(\operatorname{pad}(m)),$$ where $\operatorname{pad}(m) = m \mathbin\Vert 0^{128 - n}$, and $0^{128 - n}$ means a string of $128 - n$ zero bits.

Note that for any message $m$ of fewer than 128 bits, $\operatorname{MAC}_k(m) = \operatorname{MAC}_k(m \mathbin\Vert 0)$. Thus if I can learn, via an oracle, the tag of any message, the same tag will authenticate the same message with zeros appended, or, if it has trailing zeros, the same message with trailing zeros stripped.

The problem is not with AES, or CBC, or CBC-MAC, or the fixed block size, or anything like that. The problem is that $\operatorname{pad}(m) = \operatorname{pad}(m \mathbin\Vert 0)$. For each padded message, there must be a unique unpadded message. This padding scheme fails that.

  • 1
    $\begingroup$ Ouch, overlooked the padding scheme. Thanks for not downvoting me, my answer was removed (of course it must be a pretty weird Oracle if it is to accept those (un)padded messages and not the original one, but theoretically at least it is broken. $\endgroup$ – Maarten Bodewes Dec 19 '17 at 8:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.