4
$\begingroup$

In the 2. edition of the Modern Introduction to Cryptography, by Katz and Lindell, there is a definition for MACs;

Canonical verification. For deterministic message authentication codes (that is, where $\text{Mac}$ is a deterministic algorithm), the canonical way to perform verification is to simply re-compute the tag and check for equality. In other words, $\operatorname{Vrfy}_k(m, t)$ first computes $\tilde{t} := \text{Mac}_k (m)$ and then outputs $1$ if and only if $\tilde{t} = t$.

Then, later

It is not hard to see that if a secure MAC uses canonical verification then it is also strongly secure. This is important since all real-world MACs use canonical verification.

All of the cryptographic MACs, that I know, use canonical verification.

  • Is there any non Canonical Verifiable Cryptographic MACs?
  • If not, then this definition is redundant, or is this definition is defined for future MAC schemes?
$\endgroup$
1
$\begingroup$

See Message Authentication, Revisited. This paper presents MACs with different properties, and in order to achieve these properties randomization is used. Since the MACs are probabilistic, the verification cannot be canonical.

$\endgroup$
  • $\begingroup$ in short, the problem starts when a Mac has randomized tags, as this is the only reason for having two different valid tags for a message $m$ $\endgroup$ – kelalaka Nov 14 '18 at 17:55
  • 1
    $\begingroup$ It's not a "problem", but a potential property. Indeed, any deterministic MAC has canonical verification in practice (you can build one that doesn't but there's no reason to). $\endgroup$ – Yehuda Lindell Nov 14 '18 at 17:59
  • $\begingroup$ This is a link only answer... please add a summary of the info within the paper. $\endgroup$ – Maarten Bodewes Nov 17 '18 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.