# Single-pass authentication with a block cipher that accepts a counter

Suppose we have a tweakable block cipher ($E(K, T, X)$ and $D(K, T, X)$) that is used in a scheme where the tweak, either in whole or in part, is used as a counter to make each block encrypt to a distinct ciphertext. If we XOR all of the blocks together and then encrypt the result, do we have a secure tag?

It is not secure if you use the $E(K, T, X)$ values as the exposed ciphertext; it is secure if you're using this scheme as a MAC (and use an independent scheme to encrypt).
If you send the $C_i = E(K, T_i, X_i)$ as the ciphertext (and send $E(K, 0, \bigoplus C_i)$ as the tag, then what the attacker could do is flip the same bit on two different $C_i$ values. The resulting $\bigoplus C_i$ will remain the same, and so the tag would validate (and the decrypted plaintext would be incorrect).
On the other hand, if you keep all the $C_i$ values internal, then this system can be viewed as a Carter-Wegman MAC. All you need to show is that $\bigoplus C_i$ is an almost universal hash function (which is fairly easy to do, assuming you get the message padding right), and the standard CW proofs apply.
• @Melab: no, there wouldn't be any particular length limitations (at least until you hit the birthday bound); the CW argument above shows that $\bigoplus C_i$ remains universal up until then (and it probably is beyond that as well, i don't have an immediate proof of that) – poncho Jan 8 '18 at 21:00