Considering public message M and private key K, would it be safe to create the MAC tag this way:

$$MAC(M,K) = AES(m_1) \oplus AES(m_2) \oplus \cdots \oplus AES(m_n)$$

when $m_1,m_2,\ldots,m_n$ are n blocks of fixed size (let's say 128).

I can't prove that it's secured although my intuition says it is.

  • $\begingroup$ Welcome to Cryptography. What is the definition of MAC for you? What is the definition of MAC forgery? Since this is HW you are going to get some hints if you show your effort. $\endgroup$
    – kelalaka
    Commented Dec 4, 2020 at 12:26
  • 3
    $\begingroup$ Hint: Does XOR have some commonly known properties that could help you here? $\endgroup$
    – SEJPM
    Commented Dec 4, 2020 at 12:37
  • 3
    $\begingroup$ @SEJPM an implicitly saying that there are at least $n!-1$ forgeries is better :) $\endgroup$
    – kelalaka
    Commented Dec 4, 2020 at 12:44
  • 2
    $\begingroup$ @kelaka you can do even better than that; you can generate a forgery for an infinite number of messages (assuming $n$ is not fixed), without seeing any valid message/tag pairs; for example, what's the MAC tag of "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" (32 'A';s) $\endgroup$
    – poncho
    Commented Dec 4, 2020 at 18:28
  • $\begingroup$ If I understand correctly if m1=m2=m3... then the result XOR will be 0, therefore this tag can be used for all of the messages with equal blocks. Is that right? $\endgroup$
    – Yuval
    Commented Dec 5, 2020 at 12:14


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.