Typically, CBC-MAC is a secure MAC for fixed length message if the construction uses a pseudorandom function. However, for a secure MAC, we can use a keyed function that is not necessarily pseudorandom. For example, the generated tag of this secure MAC can be the output of a pseudorandom function (F) appended by a string of 0s, i.e., $F_k(message)||0^n$.

My question: how do we construct a secure MAC and use it to replace the pseudorandom random function in the CBC-MAC, such that CBC-MAC is NOT secure anymore for fixed length messages? Any hints or clues?

This question is found in "Introduction to Modern Cryptography" by Katz and Lindell.

  • 1
    $\begingroup$ Generally we require some info what has been tried to solve the problem if the question is an assignment or similar. $\endgroup$
    – Maarten Bodewes
    Aug 17 '18 at 1:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.