I am having some troubles understanding the power of an adversary in attack against a MAC.

  1. In chapter 4 in Introduction of Modern Cryptography by Jonathan Katz and Yehuda Lindell, specifically in the message authentication experiment ($Mac-forge_{A,\Pi}(n)$), an adversary $A$ is given access to MAC oracle $Mac_k(\cdot)$ where $k$ is previously generated by $Gen$. So my question is: Is it right that $A$ can only access to $Mac(\cdot)$ with a fixed key $k$? Can $A$ access to $Mac(\cdot)$ with a different key $k'$ in a same experiment?
  2. In the paper The Power of Verification Queries in Message Authentication and Authenticated Encryption, specifically in Claim 4.2, it is stated that adversary $A$ simply runs algorithm $Mac(\cdot)$ with key $L$ and message $M$ (where $L$ is a key forged by $A$). I do not understand this part.

Question: How does $A$ run the algorithm if it is not a $Mac$ query? If possible, could you please provide an example in reality?


In modern cryptography it is generally assumed that algorithms are public and only the key is kept private. Thus, the adversary can compute $\operatorname{Mac}(k', m)$ for any key $k'$ and message $m$.

The oracle $\operatorname{Mac}_k(\cdot)$ in the experiment allows $A$ to additionally receive valid macs under the challenge-key $k$ for which it is supposed to forge a valid mac (for some message $m^\ast$ that it has not queried from said oracle).

The same goes for the second part of your question: the algorithm is public, so $A$ can run it on any input.

  • $\begingroup$ Oh thank you so much. Now I understand it now. $\endgroup$ Mar 6 '20 at 2:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.