# CBC encryption + CBC MAC reusing key in MAC-then-Encrypt

I'm reading the Handbook of Applied Cryptography by ‎Alfred J. Menezes et al. Especially, I'm stuck with the case that reusing key for CBC encryption and CBC-MAC in MAC-then-encrypt structure.

My question is: in MAC-then-encrypt structure, that textbook's p.367 states

Example (improper combination of CBC-MAC and CBC encryption) Consider using the data integrity mechanism of equation $$\big(\ C'=E_k(x\mathbin\|h_{k'}(x))\ \big)$$, with $$E_k$$ being CBC-encryption with key $$k$$ and initialization vector $$IV$$, $$\ h_{k'}(x)$$ being CBC-MAC with $$k'$$ and $$IV'$$, and $$k=k'$$, $$IV=IV'$$. The data $$x=x_1\mathbin\|x_2\mathbin\|\ldots\mathbin\|x_t$$ can then be processed in a single CBC pass, since the CBC-MAC is equal to the last ciphertext block $$c_t=E_k(c_{t−1}\oplus x_t)$$, and the last data block is $$x_{t+1}=c_t$$, yielding final ciphertext block $$c_{t+1}=E_k(c_t\oplus x_{t+1})=E_k(0)$$. The encrypted MAC is thus independent of both plaintext and ciphertext, rendering the integrity mechanism completely insecure. Care should thus be taken in combining a MAC with an encryption scheme. In general, it is recommended that distinct (and ideally, independent) keys be used.

Why is it problem that MAC is independent of both plaintext and ciphertext? Are there any instances where an attacker could use this fact? (I know that MAC-then-encrypt structure vulnerable to padding oracle attack.. however, in that case, the attacker could perform the actual attack.) I think that encrypted MAC part always results in 0 being encrypted, but there is no practical way to exploit this fact. Isn't it?

• Hint: assume you intercept an encrypted+MACed block, and change one bit of what the legitimate receiver gets. On what condition will the modified block be nevertheless accepted by the receiver? Perhaps, generalize for more bits and otherwise altered messages. Will the decrypted plaintext be changed? Does that goes against the security definition of a cipher ? Of a MAC? – fgrieu May 2 at 11:45
• @fgrieu I got this fact. Let C = C1||C2||C3||...||Cn. and corresponding plaintext : X = X1||X2||X3||...||Xn. If I change 1 bit of C2, then that affects X2, X3. And it will eventually have the same value as the previous tag(MAC process). If different key used(encryption, MAC) in such a situation, the error would have been detected during the MAC verification process. But, how does that relate to the last block of ciphertext being encrypted with 0? – PioneerBaek May 2 at 12:50
• "how does that relate to the last block of ciphertext being encrypted with 0?": not, and no, the last block of ciphertext is not encrypted with 0. The quote's statement is that the last block of ciphertext is 0 encrypted with the key, and that therefore it is constant. But you did not ask why is the last block of ciphertext 0 encrypted with the key nor why is the last block of ciphertext constant (hint; that involves $\forall x,\ x\oplus x=0$). You asked "Why is it problem that MAC is independent of both plaintext and ciphertext?" (hint: it does not hold). – fgrieu May 2 at 15:48
• @fgrieu My intention seems to have been misrepresented. I understood the fact that the last block of ciphertext is 0 encrypted with the key, and that therefore it is constant. I'm just curious why in the last quote that they emphasize that the last block is a constant. Even if they don't mention it, if they change C2 (as I mentioned method above.. they affect only X2, X3..(decrpytion process), then get the same MAC.. isn't it? My point is.. "Why is the comment needed that encrypted MAC part is constant?" – PioneerBaek May 3 at 6:13

In the context, it gets worse than letting garbage pass the MAC check: CBC encryption is malleable enough that the adversaries can partially choose the deciphered plaintext. For example, with a long known plaintext, they can copy/paste large segments of ciphertext, cutting at block boundaries, and that does the same for deciphered plaintext, albeit with one block of garbage after each cut. Other example (that can combine): an adversary can put an arbitrary chosen value one block wide in the deciphered plaintext, by putting it in a ciphertext block followed by a copy of the last block $$E_k(0)$$.