0
$\begingroup$

A fixed-length CBC-MAC uses zero block as IV (initialization vector) to prevent from changing the first block.

i.e. tag $t$ = $F(m_x \oplus ... F(m_3 \oplus F(m_2 \oplus F(m_1)))...)$

My question is, if the first block is used as IV, then is it secure (unforgeable), and why? (not for encryption/confidentiality, and just for authentication)

i.e. tag $t$ = $F(m_x \oplus ... F(m_4 \oplus F(m_3 \oplus F(m_1 \oplus m_2)))...)$

Thank you.

$\endgroup$

1 Answer 1

0
$\begingroup$

My question is, if the first block is used as IV, then is it secure (unforgeable), and why?

Suppose with this scheme, you have the MAC for the message $[m_1, m_2, m_3]$. Could someone without the key compute the MAC for the message $[m_2, m_1, m_3]$?

$\endgroup$
2
  • $\begingroup$ Thank you for your reply. I have one more question. Then, if a system allows reordering, (for example, if $m_1$ is a header), then the MAC is still insecure? $\endgroup$
    – takita
    Commented Apr 17, 2018 at 20:37
  • $\begingroup$ How about $[m_1 \oplus 1, m_2 \oplus 1, m_3]$. Now, if $m_1$ is fixed, it works, but if it's fixed, why include it in the MAC? $\endgroup$
    – poncho
    Commented Apr 17, 2018 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.