In the 2. edition of the Modern Introduction to Cryptography, by Katz and Lindell, there is a definition for MACs;

Canonical verification. For deterministic message authentication codes (that is, where $\text{Mac}$ is a deterministic algorithm), the canonical way to perform verification is to simply re-compute the tag and check for equality. In other words, $\operatorname{Vrfy}_k(m, t)$ first computes $\tilde{t} := \text{Mac}_k (m)$ and then outputs $1$ if and only if $\tilde{t} = t$.

Then, later

It is not hard to see that if a secure MAC uses canonical verification then it is also strongly secure. This is important since all real-world MACs use canonical verification.

All of the cryptographic MACs, that I know, use canonical verification.

  • Is there any non Canonical Verifiable Cryptographic MACs?
  • If not, then this definition is redundant, or is this definition is defined for future MAC schemes?

1 Answer 1


See Message Authentication, Revisited. This paper presents MACs with different properties, and in order to achieve these properties randomization is used. Since the MACs are probabilistic, the verification cannot be canonical.

  • 3
    $\begingroup$ It's not a "problem", but a potential property. Indeed, any deterministic MAC has canonical verification in practice (you can build one that doesn't but there's no reason to). $\endgroup$ Commented Nov 14, 2018 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.