2
$\begingroup$

Especially in the context of Encrypt-then-Authenticate.

$\endgroup$
  • $\begingroup$ Strong Mac? $\endgroup$ – kelalaka Oct 21 '18 at 16:14
  • 3
    $\begingroup$ Can you please link the paper / resource where a "strong MAC" is mentioned / defined? $\endgroup$ – SEJPM Oct 21 '18 at 16:44
  • $\begingroup$ Do you mean strong existential unforgeability vs. existential unforgeability? $\endgroup$ – Maeher Oct 22 '18 at 8:20
4
$\begingroup$

I assume that by a "strong MAC" you mean that it is infeasible for an adversary to also find a different MAC tag on a message which has been tagged. Any deterministic MAC (with canonical verification) is a strong MAC, but it is certainly not the case that every MAC is a strong MAC. Thus, indeed, there exist secure MAC schemes (that are existentially unforgeable) but are not strong MACs, meaning that this is a strictly stronger notion (by definition, a strong MAC is existentially unforgeable so the question is just whether it's the same or strictly stronger as a notion). Note that in order to achieve CCA security you need a strong MAC and thus in the context of encrypt-then-authenticate, this is indeed needed. It is possible to define a weaker type of authenticated channel for which it would not be necessary, but typically it is required.

For those not sure what a strong MAC is, see the following pasted excerpt from "Introduction to Modern Cryptography":

strong MAC excerpt

| improve this answer | |
$\endgroup$
  • $\begingroup$ I see, thanks! I asked this question as I believed existential unforgeability would be sufficient in authenticated encryption. $\endgroup$ – Awesoemness Yeah Oct 22 '18 at 17:07
  • 1
    $\begingroup$ @kelalaka Yes; in the second edition. $\endgroup$ – Yehuda Lindell Oct 23 '18 at 12:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.