0
$\begingroup$

I've been puzzling over the following proof for the past couple of days.

Since a block cipher in CBC mode can be used to build both an IND-CPA secure encryption scheme and a EUF-CMA secure block, a common mistake made in “roll-your-own” cryptosystems is to try to use the last ciphertext block to compute a MAC on the plaintext, e.g. to encrypt the message m, we compute the ciphertext $c = \verb|CBCEncrypt|^E _K(m)$, let $c^∗$ be the last block, compute tag $\tau = E_K(c^*)$. and use $⟨c, τ⟩$ as an “authenticated encryption” scheme. Prove that this scheme fails to provide chosen-ciphertext security.

I'm making the assumption that an encryption oracle for $\verb|CBCEncrypt|^{E}_K(m)$ uniformly chooses an IV and then makes it public after encryption. Also, $E_K$ is the block function.

One security issue that comes to mind is that the tag of a message in this scheme relies only on the last block of ciphertext, not the rest of the message. However, since each IV is random and unpredictable, I don't see how an adversary could exploit this.

Another thought I had was if an adversary could compute a valid tag $\tau_{\tau}$, then they could decrypt $⟨\tau, \tau_{\tau}⟩$ and check whether or not the resultant decryption (with IV=0) is equal to the last block of the corresponding ciphertext $\tau$ was generated from. But again, I can't see how an adversary could compute $\tau_{\tau}$.

Any help would be appreciated.

$\endgroup$
1
  • 1
    $\begingroup$ No idea if it's exploitable, but at the very minimum, it defeats the purpose of Encrypt then MAC which is done so that you don't decrypt before verifying. If one of the intermediate cipher text blocks is tampered, the verification will succeed & you will know something is wrong only after you do the decryption. $\endgroup$ – user93353 Mar 19 at 1:13
0
$\begingroup$

One security issue that comes to mind is that the tag of a message in this scheme relies only on the last block of ciphertext, not the rest of the message.

So, what would happen if the adversary took a valid $⟨c, \tau⟩$ pair and modified $c$ by repeating the last block, that is, converting it into the pair $⟨c || c^*, \tau⟩$ and forwarding that to the decryptor?

Would the modified ciphertext pass the integrity check?

Bonus question (to make the attack even worse): if it did, what would the resulting plaintext look like?

$\endgroup$
1
  • $\begingroup$ Simply passing the integrity check is not enough to break CCA security, although it is enough to break AE. For CCA security, it is important that the result of decryption leaks information about the challenge plaintext. $\endgroup$ – Mikero Mar 19 at 5:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.