Is Cipher based message authentication (CMAC) susceptible to block reordering (just like CBC)?


No, CMAC is not susceptible to block reordering.

Unlike CBC, the attacker does not see the values of the intermediate encryptions (and because of the tweak applied to the last block, he can't find that out by asking for the MAC of prefixes). Hence, the attack cannot modify the plaintext (including reordering blocks) in a way to make a predictable change to the hash output.

  • $\begingroup$ Thanks for quick response. How attacker does not see the values of intermediate encryptions? From looking at CMAC & CBC MAC, it looks the process is same (except the tweak applied to last block) $\endgroup$ – user2896215 Jun 27 '18 at 4:22
  • $\begingroup$ @user2896215: with CBC MAC, the attacker can determine the result of an intermediate computation by truncating the plaintext, and asking for the CBC-MAC of that. For example, if the attacker has the CBC-MAC of (A B), and wants to know the intermediate value after the first step, he just asks for the CBC-MAC of (A). $\endgroup$ – poncho Jun 27 '18 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.