# Finding IV for forgery of AES CBC-MAC with non-fixed IV

As CBC mode might do several rounds, how it could be possible to find another IV for forgery attack?

This is an example from my course: Assume you receive a pair with the plaintext $$P_1$$ and its MAC using an original $$IV_1$$. If you want to change $$P_1$$ to another plaintext $$P_2$$, how to find the $$IV_2$$?

As said in explanation, the process could be:
$$MAC = E(P_1 \oplus IV_1)$$
$$MAC = E(P_2 \oplus IV_2)$$

so,
$$IV_2 = P_1\oplus IV_1 \oplus P_2$$

Why it is possible?

I test it with cryptool2 but it doesn't work...

• What if you set the plaintext some value that will result in as $P_1 \oplus IV_1$ or $P_2 \oplus IV_2$? $P = IV_2 \oplus P_1 \oplus IV_1$ May 20 at 0:44
• Yes, it does work. So, is it mean that in CBC, no matter how many round it encrypted, using XOR is able to figure out one of these values if knowing the other three? May 20 at 0:57

This is a demonstration of MAC forgery. This is not the CBC-MAC where the IV is always set to zero and there is also, ECBC-MAC as encrypt the last block which doesn't need the length of the message beforehand to be secure.

Given a MAC, its plaintext $$P_1$$, and the $$IV_1$$ on this simple CBC-MAC $$MAC_1 = E(P_1\oplus IV_1)$$

We want to forge a signature based on this;

$$MAC_2 = E(P_2\oplus IV_2)$$

and we want a forgery without even knowing the key. Since the IV is not fixed, we can play around with it.

Set an IV so that the resulting X-or with the plaintext will be equal to the giving message and its IV. The plaintext will be different, however, the MAC value will be the same; a forgery!

Take $$P_2$$ be the target message to be forged into the signature.

Take $$IV_2 = \underbrace{P_1\oplus IV_1}_{\text{cancel part}} \oplus \underbrace{P_2}_{\text{target message}}$$

check $$P_2 \oplus IV_2 = P_2 \oplus P_1\oplus IV_1 \oplus P_2$$

simplify $$P_2 \oplus IV_2 = P_1\oplus IV_1$$

and, this is a forgery since we have a different message and IV that it's x-or equal to the given MAC. This can happen since the attacker can choose the IV. To mitigate take the IV fixed as in the CBC-MAC.

As CBC mode might do several rounds, how it could be possible to find another IV for forgery attack?

The above example was for messages of one block. For multiple blocks, just set the first block as above, and keep the remaining blocks are the same. This will be multiple block messages forgery on this signature scheme.

• Thank you very much for your explain. I totally understand!. The most confused part for me was about multiple blocks... This is clear. Thanks a lot! May 22 at 12:52