1
$\begingroup$

The title mostly explains it;

  • CBC-MAC variable-length weakness with MAC size greater than the encryption block size

I've seen that by having the pairs $(M,T_m)$ and $(N,T_n)$, we can generate a third message $M'$ whose CBC-MAC will also be $T_n$ by simply doing $M'=M \mathbin\| ((n_1 \oplus T_m) \mathbin\| n_2 \ldots n_x)$

My question is how does this work when the MAC is of greater size than the block size used during encryption? In my specific case, the MAC is 20 bytes while the encryption blocks are 16 bytes. So far I have not seen any ways of dealing with this

Improve this question
$\endgroup$
2
  • 2
    $\begingroup$ Congratulation for having an aha moment much by yourself. An AES-CBC-MAC is at most 16 bytes (often less, for it is truncated). unless there is some post encoding. E.g. Base85 would turn a 16-byte MAC into a 20-byte ASCII string restricted to printable ASCII. But in order to carry the attack, you do not need to know the details of that encoding, unless the input is encoded too. $\endgroup$
    – fgrieu ♦
    Commented Oct 31, 2020 at 8:01
  • $\begingroup$ @fgrieu I have seen that its only 16 bytes. Seems its been extended to help me understand CBC more.. $\endgroup$
    – Ben
    Commented Oct 31, 2020 at 23:09

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.