In Katz's text (2nd edition), it states in 4.3.2:

  1. The truncation attack can be thwarted by additionally authenticating the message length along with each block. (Authenticating the message length as a separate block does not work. Do you see why?) That is, compute $t_{i} = Mac'_{k}(l||m||i)$ for all $i$, where $l$ denotes the length of the message in bits. (Once again, the block length $|mi|$ will need to decrease.) This scheme is vulnerable to a “mix-and-match” attack...

I don't understand the "do you see why" part. Why can't we just use the first block to provide the length, and a tag along with it to authenticate the length, and an index to verify that it is the first block? For later blocks, we just give the message and the index, and don't have to give the length, since it was already given in the first block.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.