0
$\begingroup$

A fixed-length CBC-MAC uses zero block as IV (initialization vector) to prevent from changing the first block.

i.e. tag $t$ = $F(m_x \oplus ... F(m_3 \oplus F(m_2 \oplus F(m_1)))...)$

My question is, if the first block is used as IV, then is it secure (unforgeable), and why? (not for encryption/confidentiality, and just for authentication)

i.e. tag $t$ = $F(m_x \oplus ... F(m_4 \oplus F(m_3 \oplus F(m_1 \oplus m_2)))...)$

Thank you.

$\endgroup$
0
$\begingroup$

My question is, if the first block is used as IV, then is it secure (unforgeable), and why?

Suppose with this scheme, you have the MAC for the message $[m_1, m_2, m_3]$. Could someone without the key compute the MAC for the message $[m_2, m_1, m_3]$?

$\endgroup$
  • $\begingroup$ Thank you for your reply. I have one more question. Then, if a system allows reordering, (for example, if $m_1$ is a header), then the MAC is still insecure? $\endgroup$ – takita Apr 17 '18 at 20:37
  • $\begingroup$ How about $[m_1 \oplus 1, m_2 \oplus 1, m_3]$. Now, if $m_1$ is fixed, it works, but if it's fixed, why include it in the MAC? $\endgroup$ – poncho Apr 17 '18 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.