For handling variable-length input and having the calculation of the MAC remain online, encrypting the output of CBC-MAC with a second key is recommended. I have not seen it said that a different key is required, but that that appears to be the implication. I don't see why a different key is necessary for encrypting the last block. Double encryption with the block cipher $E(K, X): \{0, 1\}^{\ell_{K}} \times \{0, 1\}^{\ell_{X}}$ could be rewritten as $F_{1}(K, X) = E(K, X)$. Then, the entire MAC procedure can be reformulated as:

  • $m$ is the number of message blocks to be authenticated.
  • $M_{i} \in \{0, 1\}^{\ell_{X}}$ is the $i$th zero-based message block to be authenticated where $0 \leq i < m$.
  • $t_{0} = F_{1}(K, M_{0})$.
  • For $0 < i < m - 1$, $t_{i} = F_{1}(K, t_{i - 1} \oplus M_{i})$.
  • The MAC, T, is calculated from $F_{2}(K, t_{m- 2} \oplus M_{m - 1})$.

With two calls to the block cipher, $F_{2}$ is a different function than $F_{1}$, the same way $E(K_{0}, X)$ is a different function of $X$ than $E(K_{1}, X)$.


1 Answer 1


Note that re-encrypting the output of CBC-MAC with the same key as it was calculated with is equivalent to appending a single all-zero cipher block to the message: $$E_K(\text{CBC-MAC}_K(m)) = E_K(\text{CBC-MAC}_K(m) \oplus 0^b) = \text{CBC-MAC}_K(m \,\|\, 0^b),$$ where $0^b$ represents a $b$-bit block of all zero bits and $b$ is the block size of the cipher.

Thus, the classic attack on unmodified CBC-MAC with variable-length messages can be easily adapted to your scheme. Specifically, let $$\begin{aligned} t\phantom{'} &= E_K(\text{CBC-MAC}_K(m)), \\ t' &= E_K(\text{CBC-MAC}_K(m')), \end{aligned}$$ and construct the message $m'' = m \,\|\, 0^b \,\|\, (t \oplus m')$, where $t \oplus m'$ represents $m'$ modified by XORing its first block with $t$. Then $$E_K(\text{CBC-MAC}_K(m'')) = E_K(\text{CBC-MAC}_K(m')) = t'.$$

  • $\begingroup$ What is $m'$ and where does it come from? $\endgroup$
    – Melab
    Mar 19, 2018 at 1:23
  • $\begingroup$ @Melab: $m$ and $m'$ are any two arbitrary messages whose MAC tags $t$ and $t'$ under your one-key-ECBC-MAC scheme are known to the attacker (and whose length, for simplicity, I assume to be a multiple of the block size). They can even be the same message, if that's what you want. $\endgroup$ Mar 19, 2018 at 10:58
  • $\begingroup$ Does this kind of attack allow a MAC for any message to be forged? $\endgroup$
    – Melab
    Mar 20, 2018 at 20:55
  • $\begingroup$ @Melab: Not quite. First, you can only forge messages that are made up by concatenating valid signed messages that you've seen. Also, the first block of the second (and later, if there's more than two) message is effectively garbled by being XORed with the MAC tag of the previous message. Your scheme (as opposed to standard CBC-MAC) also adds the constraint that the concatenated parts of the forged message must be separated by all-zero blocks. So it's not a fully generic forge-anything attack, but it's still flexible enough to be potentially exploitable under suitable circumstances. $\endgroup$ Mar 20, 2018 at 21:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.