4
$\begingroup$

As we know, AES-256 is a block cipher with 256-bit key and 128-bit block size.

The CMAC message authentication code outputs tag length equal to block cipher block size - thus 128 bits with AES. And this provides an assurence that only 1 in 2^128 attempts in forgery may possibly succeed.

So is there any point using a 256-bit key as may be the case with AES-256?

Improve this question
$\endgroup$
1
  • $\begingroup$ If you use AES-128 an attacker may find (in theory) brute-forcing the 128-bit key to be easier than trying the random forging approach, especially if it's a protocol like TLS that rekeys after a single MAC fail. $\endgroup$
    – SEJPM
    Dec 22, 2018 at 15:05

2 Answers 2

Reset to default
5
$\begingroup$

Brute forcing ciphertext an offline attack, while attacking the authentication tag (the result of the CMAC-calculation) is an online attack: it requires an active oracle. That is: you can try and break the confidentiality of a message on your own PC network of computers. However, you need to send many ciphertext (including authentication tag) to a receiver to see if a guessed tag is correct or not and an invalid ciphertext is accepted (to test if a message is successfully forged). Generally you only get one oracle, and the speed of this oracle is usually limited (e.g. by networking speeds).

If an authentication tag is not accepted then that doesn't give any information to an attacker if the next message changes. This would for instance be the case if a unique sequence number is included in the messages (although usually the authentication tag is verified earlier, so oracle attacks would be possible). Furthermore, many protocols will break a session and re-establish the session keys if an incorrect authentication tag is received.

In conclusion: attacking an authentication tag is much harder than breaking a cipher, even if the order of the attack is the same. Because of this it makes sense to increase the key size even if the tag size stays the same.

If you need more than 128 bits of security is of course another question; 128 bits seems plenty as long as quantum computers are not available. 256 bit encryption should be considered for messages that require long-term protection.

Improve this answer
$\endgroup$
2
$\begingroup$

From rfc4493 (The AES-CMAC Algorithm);

The security provided by AES-CMAC is built on the strong cryptographic algorithm AES. However, as is true with any cryptographic algorithm, part of its strength lies in the secret key, K, and the correctness of the implementation in all of the participating systems.

As the standard states; the longer key the harder to forgery. However, the standard is not mentioning about using the AES with 256-bit key.

Your suggestion to increase the key size to 256-bit will definitely make the brute-force infeasible for a long time.

To forge a message by trying every tag is measured by the tag space, in this case, the attacker needs to attack $128$-bit and this is always same for AES.

Improve this answer
$\endgroup$
2
  • $\begingroup$ I'm finding your answer here a bit hard to follow. In particular, in the last paragraph you write about "the case of the brute force", even though both trying all $2^{256}$ keys and trying all $2^{128}$ tags would generally be considered brute force attacks. $\endgroup$
    – Ilmari Karonen
    Dec 22, 2018 at 19:46
  • $\begingroup$ @IlmariKaronen clear now? $\endgroup$
    – kelalaka
    Dec 22, 2018 at 20:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.