0
$\begingroup$

Is Cipher based message authentication (CMAC) susceptible to block reordering (just like CBC)?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
4
$\begingroup$

No, CMAC is not susceptible to block reordering.

Unlike CBC, the attacker does not see the values of the intermediate encryptions (and because of the tweak applied to the last block, he can't find that out by asking for the MAC of prefixes). Hence, the attack cannot modify the plaintext (including reordering blocks) in a way to make a predictable change to the hash output.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Thanks for quick response. How attacker does not see the values of intermediate encryptions? From looking at CMAC & CBC MAC, it looks the process is same (except the tweak applied to last block) $\endgroup$
    – user2896215
    Commented Jun 27, 2018 at 4:22
  • $\begingroup$ @user2896215: with CBC MAC, the attacker can determine the result of an intermediate computation by truncating the plaintext, and asking for the CBC-MAC of that. For example, if the attacker has the CBC-MAC of (A B), and wants to know the intermediate value after the first step, he just asks for the CBC-MAC of (A). $\endgroup$
    – poncho
    Commented Jun 27, 2018 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.