# CBC-MAC variable-length weakness with MAC size greater than the encryption block size

The title mostly explains it;

• CBC-MAC variable-length weakness with MAC size greater than the encryption block size

I've seen that by having the pairs $$(M,T_m)$$ and $$(N,T_n)$$, we can generate a third message $$M'$$ whose CBC-MAC will also be $$T_n$$ by simply doing $$M'=M \mathbin\| ((n_1 \oplus T_m) \mathbin\| n_2 \ldots n_x)$$

My question is how does this work when the MAC is of greater size than the block size used during encryption? In my specific case, the MAC is 20 bytes while the encryption blocks are 16 bytes. So far I have not seen any ways of dealing with this

• Congratulation for having an aha moment much by yourself. An AES-CBC-MAC is at most 16 bytes (often less, for it is truncated). unless there is some post encoding. E.g. Base85 would turn a 16-byte MAC into a 20-byte ASCII string restricted to printable ASCII. But in order to carry the attack, you do not need to know the details of that encoding, unless the input is encoded too. – fgrieu Oct 31 '20 at 8:01
• @fgrieu I have seen that its only 16 bytes. Seems its been extended to help me understand CBC more.. – Ben Oct 31 '20 at 23:09