I don't understand why $\text{CBC-MAC}(M) = \text{CFB-MAC}(M)$. Has it something to do with $\text{CBC-MAC}(M) = C_L$ and $\text{CFB-MAC}(M) = E_K(C'_{L-1})$?
$\begingroup$
$\endgroup$
1
-
$\begingroup$ You can use MathJax / $\LaTeX$ on our site, you just got to put it within dollar signs, e.g. '\$\square\$' gives you $\square$ $\endgroup$– Maarten Bodewes ♦Dec 1, 2021 at 17:14
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
For a block cipher $E_k()$, consider the following process applied to a message $M$ of length $\ell$ blocks $M_0,\ldots,M_{\ell-1}$ $$X_0=0$$ $$Y_i=X_i\oplus M_i$$ $$X_{i+1}=E_k(Y_i).$$ In CBC encryption with 0 IV the ciphertext is the sequence $X_1,\ldots,X_{\ell}$ and in CFB encryption with IV $E^{-1}_k(0)$ the ciphertext is the sequence $Y_0,\ldots, Y_{\ell-1}$.
CBC-MAC is simply the final block of ciphertext: in our notation $X_\ell$. CFB-MAC is the encryption of the final block of cipher (without this it is trivial to modify $M_{\ell-1}$ and forge a MAC): in our notation $E_k(Y_{\ell-1})=X_\ell$.
Note that CFB can be used to encrypt “segments” of data smaller than the block size whereas CBC cannot. In such cases, there is no equivalence.
