# CBC-MAC , fixed length, all blocks returned

CBC-MAC, with fixed length message.

Is it safe to return all ciphered blocks instead of the last?

My intuition says it is less secure, since is gives an attacker more information. But how could one attack this scheme?

• Why you want to do that? What is the scenario? – curious May 3 '13 at 10:47
• I'm not seeing a practical use of this. I just want to know, in theory, why this is insecure. – danieltorres May 3 '13 at 11:13

I'll assume All ciphered blocks means the same as ciphertext for CBC-Encryption with implicit zero IV, while CBC-MAC is the last block of that.

All ciphered blocks is unsafe as a message authenticator for messages longer than one block, for it succumbs to a trivial attack (here with two blocks):

• Eve intercepts message $$M=M_0||M_1$$ and its authenticator $$A=A_0||A_1$$
• she knows $$A_0=E(M_0)$$ and $$A_1=E(A_0\oplus M_1)$$
• she builds $$M'=(A_0\oplus M_1)||(A_1\oplus M_0)$$ and its authenticator $$A'=A_1||A_0$$.

The verifier will then accept as valid $$M'$$ and its authenticator $$A'$$ just as well as $$M$$ and its authenticator $$A$$.

Addition for completeness: $$M'\ne M$$ unless $$M_1=M_0\oplus E(M_0)$$, which is extremely unlikely to occur by chance.

• I can't believe the #523 corrected the #9,725 :) – curious May 7 '13 at 8:29
• @curious Even the best authors make typos ... and when not native in English (as me and fgrieu), we tend to overlook them sometimes. Luckily Crypto SE reputation doesn't mirror mainly English language knowledge. Thanks for your correction, and feel free to suggest edits wherever you find typos or other kind of mistakes. (When it is not totally obvious that it is a mistake, a comment might be better, though.) – Paŭlo Ebermann May 11 '13 at 22:22
• I thought CBC-MAC would take the last block as the MAC value. So for $Mac_k(M)=A_1$ and $Mac_k(M')=A_0$, how did you verify when we get two different MAC? – user153882 Dec 2 '16 at 23:38
• @user153882: Indeed, CBC-MAC uses as MAC the last block of CBC encryption (with zero IV); and is safe. But this question is for a different MAC. – fgrieu Dec 4 '16 at 18:37