# Attacks on the RawCBC-MAC if the final step of encrypting with a second key isn't done

This is from Boneh's lecture ECBC-MAC

Here is also a link to the lecture itself - https://www.coursera.org/learn/crypto/lecture/QYT6i/cbc-mac-and-nmac

CBC-MAC with $$(K_1, K_2)$$ on a message $$M$$ applies RawCBCMAC with $$K_1$$ to message $$M$$ & takes the output tag & runs the PRF on the tag using a second key $$K_2$$

Boneh explains a chosen message attack on RawCBCMAC

• Ask the oracle for the tag on a 1 block message $$m$$. Let's say the tag is $$t$$.
• Now the same tag $$t$$ will also be the tag for a 2nd message $$(m || t \oplus m)$$

Yes, this will indeed work.

I can think of another attack on the RawCBCMAC

• Ask the oracle for the tag on a message $$m$$ (can be any number of blocks). Let's say the tag is $$t$$.

• Ask the oracle for the tag on a single block message ($$w \oplus t$$). Let's say the tag is $$t'$$

• Now the tag for the message $$(m || w)$$ is same as $$t'$$

Is this also a valid attack on RawCBC or am I missing something?

Yes. Writing down the expressions, we get $$t=F(k,m)$$ and $$t'=F(k,w\oplus t)$$ - while abusing notation and meaning RawCBCMAC for multi-block invocations of $$F$$. Now the actual tag for $$(m\|w)$$ would be $$t''=F(k,F(k,m)\oplus w)=F(k,t\oplus w)$$ which is equal to $$t'$$.