Especially in the context of Encrypt-then-Authenticate.

  • $\begingroup$ Strong Mac? $\endgroup$
    – kelalaka
    Commented Oct 21, 2018 at 16:14
  • 3
    $\begingroup$ Can you please link the paper / resource where a "strong MAC" is mentioned / defined? $\endgroup$
    – SEJPM
    Commented Oct 21, 2018 at 16:44
  • $\begingroup$ Do you mean strong existential unforgeability vs. existential unforgeability? $\endgroup$
    – Maeher
    Commented Oct 22, 2018 at 8:20

1 Answer 1


I assume that by a "strong MAC" you mean that it is infeasible for an adversary to also find a different MAC tag on a message which has been tagged. Any deterministic MAC (with canonical verification) is a strong MAC, but it is certainly not the case that every MAC is a strong MAC. Thus, indeed, there exist secure MAC schemes (that are existentially unforgeable) but are not strong MACs, meaning that this is a strictly stronger notion (by definition, a strong MAC is existentially unforgeable so the question is just whether it's the same or strictly stronger as a notion). Note that in order to achieve CCA security you need a strong MAC and thus in the context of encrypt-then-authenticate, this is indeed needed. It is possible to define a weaker type of authenticated channel for which it would not be necessary, but typically it is required.

For those not sure what a strong MAC is, see the following pasted excerpt from "Introduction to Modern Cryptography":

strong MAC excerpt

  • $\begingroup$ I see, thanks! I asked this question as I believed existential unforgeability would be sufficient in authenticated encryption. $\endgroup$ Commented Oct 22, 2018 at 17:07
  • 1
    $\begingroup$ @kelalaka Yes; in the second edition. $\endgroup$ Commented Oct 23, 2018 at 12:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.