CBC-MAC, with fixed length message.
Is it safe to return all ciphered blocks instead of the last?
My intuition says it is less secure, since is gives an attacker more information. But how could one attack this scheme?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
I'll assume All ciphered blocks means the same as ciphertext for CBC-Encryption with implicit zero IV, while CBC-MAC is the last block of that.
All ciphered blocks is unsafe as a message authenticator for messages longer than one block, for it succumbs to a trivial attack (here with two blocks):
The verifier will then accept as valid $M'$ and its authenticator $A'$ just as well as $M$ and its authenticator $A$.
Addition for completeness: $M'\ne M$ unless $M_1=M_0\oplus E(M_0)$, which is extremely unlikely to occur by chance.