# When extending the domain of a fixed-length MAC, why do we have to include the message length in each block?

In Katz's text (2nd edition), it states in 4.3.2:

1. The truncation attack can be thwarted by additionally authenticating the message length along with each block. (Authenticating the message length as a separate block does not work. Do you see why?) That is, compute $$t_{i} = Mac'_{k}(l||m||i)$$ for all $$i$$, where $$l$$ denotes the length of the message in bits. (Once again, the block length $$|mi|$$ will need to decrease.) This scheme is vulnerable to a “mix-and-match” attack...

I don't understand the "do you see why" part. Why can't we just use the first block to provide the length, and a tag along with it to authenticate the length, and an index to verify that it is the first block? For later blocks, we just give the message and the index, and don't have to give the length, since it was already given in the first block.

## 1 Answer

I suspect it is because you can still do a truncation attack under specific circumstances. Say an adversary obtains the tag of another message m' that is shorter than the original message m. Then the adversary can replace the first block from m (the one containing the length) with the first block from m', and also replace the first element in the tag for m with the first element from the tag for m'.

Similary, if the message m' is larger, then a message extension attack becomes possible...