7
$\begingroup$

CBC-MAC, with fixed length message.

Is it safe to return all ciphered blocks instead of the last?

My intuition says it is less secure, since is gives an attacker more information. But how could one attack this scheme?

$\endgroup$
2
  • 2
    $\begingroup$ Why you want to do that? What is the scenario? $\endgroup$
    – curious
    Commented May 3, 2013 at 10:47
  • 1
    $\begingroup$ I'm not seeing a practical use of this. I just want to know, in theory, why this is insecure. $\endgroup$ Commented May 3, 2013 at 11:13

1 Answer 1

14
$\begingroup$

I'll assume All ciphered blocks means the same as ciphertext for CBC-Encryption with implicit zero IV, while CBC-MAC is the last block of that.

All ciphered blocks is unsafe as a message authenticator for messages longer than one block, for it succumbs to a trivial attack (here with two blocks):

  • Eve intercepts message $M=M_0||M_1$ and its authenticator $A=A_0||A_1$
  • she knows $A_0=E(M_0)$ and $A_1=E(A_0\oplus M_1)$
  • she builds $M'=(A_0\oplus M_1)||(A_1\oplus M_0)$ and its authenticator $A'=A_1||A_0$.

The verifier will then accept as valid $M'$ and its authenticator $A'$ just as well as $M$ and its authenticator $A$.

Addition for completeness: $M'\ne M$ unless $M_1=M_0\oplus E(M_0)$, which is extremely unlikely to occur by chance.

$\endgroup$
4
  • $\begingroup$ I can't believe the #523 corrected the #9,725 :) $\endgroup$
    – curious
    Commented May 7, 2013 at 8:29
  • $\begingroup$ @curious Even the best authors make typos ... and when not native in English (as me and fgrieu), we tend to overlook them sometimes. Luckily Crypto SE reputation doesn't mirror mainly English language knowledge. Thanks for your correction, and feel free to suggest edits wherever you find typos or other kind of mistakes. (When it is not totally obvious that it is a mistake, a comment might be better, though.) $\endgroup$ Commented May 11, 2013 at 22:22
  • $\begingroup$ I thought CBC-MAC would take the last block as the MAC value. So for $Mac_k(M)=A_1$ and $Mac_k(M')=A_0$, how did you verify when we get two different MAC? $\endgroup$
    – user153882
    Commented Dec 2, 2016 at 23:38
  • $\begingroup$ @user153882: Indeed, CBC-MAC uses as MAC the last block of CBC encryption (with zero IV); and is safe. But this question is for a different MAC. $\endgroup$
    – fgrieu
    Commented Dec 4, 2016 at 18:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.