So given you can find a collision for any MAC value, would this be viable without knowing the key. Even if you couldn't figure out how that MAC function works, could you find valid MAC values for a message without needing to know how it works.

If so how would you go about doing this.


No you would generally not be able to do this. If you find a collision without a key then it's just an indication that the output size is too small. Quite often the MAC depends on a block cipher or hash function. The latter is one-way by definition, the former is one-way unless you know the key.

It's of course a different proposition if you find a MAC collision because you found a weakness in the algorithm or the establishment of the secret key. If an attacker found a weakness it is very likely that the attacker already knows the algorithm. And yeah, if an attacker know the key the game is over. Finding another collision might still be tricky if the output size is large enough, depending on the algorithm used.

"could you find valid MAC values for a message without needing to know how it works". No, with the possible exception that length extension attacks may work, e.g. for CBC-MAC and CMAC. This would require the full output of the calculation though, so chances are that you will not find a collision for a cipher with a large enough block size (e.g. AES instead of DES).

  • 1
    $\begingroup$ A similar "length extension" attack applies to CMAC if you find a collision; if $CMAC_k(M) = CMAC_k(M')$ (and, for simplicity, both $M$ and $M'$ are multiples of the block size in length), then $CMAC_k(M || X) = CMAC_k(M' || X)$ for any string $X$ $\endgroup$ – poncho Nov 24 '20 at 14:47
  • $\begingroup$ @poncho Note that this question about CMAC length extension is still open! $\endgroup$ – Maarten Bodewes Nov 24 '20 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.