0
$\begingroup$

There are may papers and notes explain why CBC-MAC is only UF-CMA secure for fix length messages. Are there any other blockcipher-based (blockcipher and hash combined included) MACs that is UF-CMA secure with variable length messages?

$\endgroup$
1
$\begingroup$

Are there any other blockcipher-based (blockcipher and hash combined included) MACs that is UF-CMA secure with variable length messages?

Sure.

The most famous one is probably CMAC (a.k.a. OMAC1) which is essentially CBC-MAC but with a key-dependent secret random value XOR'ed with the last message block1.

Alternatively there is a general theorem that $F_k(H_\kappa(m))$ is a PRF (and thus a secure MAC) as long as $F$ is a secure fixed-length PRF and $H$ is a collision-resistant (potentially-keyed) hash function. You can find a proof of this e.g. in the Boneh-Shoup book (section 7). This e.g. brings the (parts of) the security proofs for HMAC and PMAC. Additionally you can somewhat easily define MACs based on this, e.g. $\operatorname{AES}_{k_1}(\operatorname{GHASH}_{k_2}(m\|\operatorname{len}(m)))$.


1: This is an accurate enough simplification of CMAC. It actually uses more than one such random value for messages that are not a multiple of the block length

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.