Consider an encrypted message
m which is encrypted with AES-CBC, so in addition to the message there is an
IV supplied initially. If I understand correctly the
IV and afterwards the prior ciphertext is used, because if wasn't used, a listening attacker could gather information about the secret key
We want to add a authentication code (MAC) to the package, however we are quite limited with the amount of bytes we have for the MAC.
Our initial idea was to use
s to generate a MAC of length
s/2. If this would be used on more than one package could the attacker gain information from it? As far as I understand it's the same problem as using a one-time-pad again and again.
If this is a problem would a possible solution to this be to XOR the message with the IV (or prior ciphertexts) and then generate the MAC with
If this doesn't solve the problem, is there any other authentication mechanism we could use, where we can decide the length of the authentication code.
Note: we already spent thoughts on the security of short MACs and don't think it's a problem in our particular scenario.