0
$\begingroup$

This is from Boneh's lecture ECBC-MAC

enter image description here

Here is also a link to the lecture itself - https://www.coursera.org/learn/crypto/lecture/QYT6i/cbc-mac-and-nmac

CBC-MAC with $(K_1, K_2)$ on a message $M$ applies RawCBCMAC with $K_1$ to message $M$ & takes the output tag & runs the PRF on the tag using a second key $K_2$

Boneh explains a chosen message attack on RawCBCMAC

  • Ask the oracle for the tag on a 1 block message $m$. Let's say the tag is $t$.
  • Now the same tag $t$ will also be the tag for a 2nd message $ (m || t \oplus m)$

Yes, this will indeed work.

I can think of another attack on the RawCBCMAC

  • Ask the oracle for the tag on a message $m$ (can be any number of blocks). Let's say the tag is $t$.

  • Ask the oracle for the tag on a single block message ($w \oplus t$). Let's say the tag is $t'$

  • Now the tag for the message $(m || w)$ is same as $t'$

Is this also a valid attack on RawCBC or am I missing something?

$\endgroup$

1 Answer 1

1
$\begingroup$

Is this also a valid attack on RawCBC [...]?

Yes. Writing down the expressions, we get $t=F(k,m)$ and $t'=F(k,w\oplus t)$ - while abusing notation and meaning RawCBCMAC for multi-block invocations of $F$. Now the actual tag for $(m\|w)$ would be $t''=F(k,F(k,m)\oplus w)=F(k,t\oplus w)$ which is equal to $t'$.

$\endgroup$
2
  • $\begingroup$ I made a mistake in my question. I really apologize for it. I have updated it now. t' is the tag of (w XOR t) & not of just w. I again apologize for the mistake $\endgroup$
    – user93353
    Commented Feb 8, 2021 at 11:01
  • $\begingroup$ @user93353 Yes, the new variant works. $\endgroup$
    – SEJPM
    Commented Feb 8, 2021 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.