Questions tagged [cbc-mac]

Cipher Block Chaining MAC (CBC-MAC) is a method of building a message authentication code from a block-cipher.

Filter by
Sorted by
Tagged with
1 vote
0 answers
29 views

CBC MAC forgery

$\text{CBC-MAC}$ is defined as follows: $\text{CBC-MAC}_k() = IV $ $\text{CBC-MAC}_k(m_1, . . . , m_n) = E_k(m_n \oplus \text{CBC-MAC}_k(m_1, . . . , m_{n−1}))$ My lecture notes say that this is ...
user avatar
0 votes
0 answers
35 views

calculate a tag of CBC-MAC

with a block cipher having a 256-bit key and 128-bit block length to MAC a 1024-bit message. How many evaluations of the block cipher will be performed to calculate the tag? [Assume there is no ...
user avatar
  • 13
1 vote
2 answers
104 views

changing messages for authentication without the tag changed. (CBC-MAC)

do you know about CBC-MAC? I have iv ,MAC and Transaction but no key. and I should change Transaction without change cipher text. do you know how this is possible at all? In addition, I do not have ...
user avatar
  • 21
1 vote
1 answer
135 views

Why a hash function in a manner similar to CBC-MAC is not collision-resistant?

I'm reading the book The Joy of Cryptography by Mike Rosulek. When reading Chapter 11, on the hash function, I found a very interesting exercise. Does anyone have ideas on how to prove this? Please ...
user avatar
3 votes
1 answer
82 views

Why does CBC-MAC(M) = CFB-MAC(M)?

I don't understand why $\text{CBC-MAC}(M) = \text{CFB-MAC}(M)$. Has it something to do with $\text{CBC-MAC}(M) = C_L$ and $\text{CFB-MAC}(M) = E_K(C'_{L-1})$?
user avatar
2 votes
1 answer
48 views

Is the tag generated in MAC equal for equal messages in CBC-MAC?

The Cipher Block Chaining algorithm for generating message authentication codes uses a 0 IV . So my understanding is that same messages will generate same MACs which seems to violate semantic ...
user avatar
1 vote
1 answer
129 views

Finding IV for forgery of AES CBC-MAC with non-fixed IV

As CBC mode might do several rounds, how it could be possible to find another IV for forgery attack? This is an example from my course: Assume you receive a pair with the plaintext $P_1$ and its MAC ...
user avatar
  • 13
0 votes
0 answers
67 views

Insecure pseudo random functions

Let $F$ be a pseudo-random function. Show that the following constructions are insecure as message authentication codes (in each case $K \in \{0,1\}^n$ is the private key): $(a)$ To authenticate a ...
user avatar
0 votes
1 answer
190 views

Attacks on the RawCBC-MAC if the final step of encrypting with a second key isn't done

This is from Boneh's lecture ECBC-MAC Here is also a link to the lecture itself - https://www.coursera.org/learn/crypto/lecture/QYT6i/cbc-mac-and-nmac CBC-MAC with $(K_1, K_2)$ on a message $M$ ...
user avatar
  • 1,678
9 votes
0 answers
120 views

Do CCM and EAX provide key commitment?

In an interesting paper called "Partitioning Oracle Attacks" by Julia Len, Paul Grubbs & Thomas Ristenpart an attack is presented on 1.5 pass AEAD schemes that utilize GMAC (GCM, AES-GCM,...
user avatar
  • 84.5k
1 vote
1 answer
103 views

Is it safe to use the CBC-MAC as a Initial Vector and Key Check Value in deterministic encryption?

I want to deterministically encrypt a short message <50 bytes with AES-128 CBC. I also want to be able to detect if the correct key is being used. Ciphertext and IV integrity will be guaranteed by ...
user avatar
1 vote
0 answers
115 views

CBC-MAC variable-length weakness with MAC size greater than the encryption block size

The title mostly explains it; CBC-MAC variable-length weakness with MAC size greater than the encryption block size I've seen that by having the pairs $(M,T_m)$ and $(N,T_n)$, we can generate a ...
user avatar
  • 11
-1 votes
1 answer
70 views

what are the things that aes cbc-mac , aes cmac guarantees?

does aes-cbc-mac guarantees integrity, authenticity and confidentiality? does aes-cmac guarantees integrity, authenticity and confidentiality? because I only know that aes-ccm guarantees all i.e. ...
user avatar
0 votes
1 answer
401 views

What will be the MAC size of AES CBC-MAC if there are suppose 10 blocks in the AES CBC-MAC?

What will be the mac size of AES CBC-MAC if there are suppose 10 blocks in the AES CBC-MAC? Will it always be 128 bits MAC size for no matter how many numbers of blocks?
user avatar
0 votes
2 answers
200 views

Showing a CBC-MAC is not preimage resistant with a proof

So hypothetically I have a an arbitrary block cipher operating in CBC-MAC mode that makes use of a public and static $IV$ as well as a static key $K$. I want to be able to that this won't be preimage ...
user avatar
2 votes
1 answer
430 views

CBC encryption + CBC MAC reusing key in MAC-then-Encrypt

I'm reading the Handbook of Applied Cryptography by ‎Alfred J. Menezes et al. Especially, I'm stuck with the case that reusing key for CBC encryption and CBC-MAC in MAC-then-encrypt structure. My ...
user avatar
  • 89
1 vote
1 answer
205 views

XCBC Authentication

So XCBC was made to counteract lengths attacks against CBC-MAC, but how exactly does the modification made defeat this attack? All I can find are a few papers on why 2-key XCBC isn't actually secure.
user avatar
  • 65
0 votes
0 answers
29 views

CBC-MAC padded message difference [duplicate]

If an attacker had a padded message and its corresponding CBC-MAC tag, how would they construct another message which produces the same tag for the same key as the original? The padding scheme used in ...
user avatar
  • 1
0 votes
0 answers
337 views

Preimage attack on cbc-mac with constant key

Is a hash function created by using CBC-MAC with one public key that does not change secure against preimage attacks? If not, how could you exploit this to find a single block message that hashes to a ...
user avatar
1 vote
0 answers
516 views

CBC-MAC Padding weaknesses

I'm trying to wrap my head around how different padding methods affect the strength of CBC-MAC's. Suppose a message is split into different blocks, m1, m2, m3 etc. and the last block is padded with 0'...
user avatar
3 votes
0 answers
80 views

What was used for symmetric message authentication before HMAC was invented?

Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else? I know about NIST FIPS 113 "Data Authentication Algorithm" ...
user avatar
  • 774
0 votes
0 answers
34 views

CBC MAC attack using Arbitrary-length Messages [duplicate]

This is from a lecture : The adversary sees the message-tag pair(m,τ), where m= (m1,m2,...,mn)The adversary sees the message-tag pair(m′,τ′), where m′= (m′1,m′2,...,m′n)The adversary computes m''=(m1,...
user avatar
  • 1
1 vote
1 answer
150 views

Why CBC-MAC encrypts at each step

Considering CBC-MAC as: $\qquad H_0 = IV = 0$ $\qquad H_i = E_k(P_i \oplus H_{i-1})$ $\qquad MAC = H_n$ What are the properties that makes this "safer" (less ...
user avatar
1 vote
0 answers
451 views

Show that the CBC-MAC construction applied to a PRP is not collision resistant

I'm trying answer the following question. Yes, it is a homework question, so I'm not asking for the answer directly but would like to get some pointers on how to solve it. So far I have spent several ...
user avatar
7 votes
2 answers
715 views

Why does the CBC-MAC require PRFs?

I'm stuck on exercise 4.19 from Introduction to Modern Cryptography. Let $F$ be a keyed function that is a secure (deterministic) MAC for messages of length $n$. (Note that $F$ need not be a ...
user avatar
  • 652
2 votes
2 answers
1k views

The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...
user avatar
3 votes
1 answer
2k views

Real time video stream AES encryption with authentication

I am now studying AES encryption for real-time video streaming. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video encryption and authentication. With MAC authentication, ...
user avatar
  • 31
2 votes
0 answers
77 views

Modify basic CBC-MAC construction using a keyed function

Typically, CBC-MAC is a secure MAC for fixed length message if the construction uses a pseudorandom function. However, for a secure MAC, we can use a keyed function that is not necessarily ...
user avatar
  • 53
4 votes
3 answers
5k views

When do I need to use CBC and HMAC?

As I know CBC does not provide integrity for the message, thus HMAC is used to provide integrity for CBC message. Also, I hear about CBC-MAC which can provide integrity and confidentiality. Which one ...
user avatar
1 vote
1 answer
86 views

CCM authenticity bound

Can someone help me understanding the CCM authenticity bound by Phillip Rogaway? i-e Success probability < $q_{\text{dec}}/2^\tau + \sigma/2^b$. $\tau$ is tag length, where as $b$ is block length. ...
user avatar
0 votes
1 answer
226 views

Cipher based message authentication (CMAC) and block reordering

Is Cipher based message authentication (CMAC) susceptible to block reordering (just like CBC)?
user avatar
3 votes
1 answer
198 views

Propagating CBC insecure Authenticated Encryption

why is Propagating CBC (PCBC) insecure for authenticated encryption? I received the hint that I should feed a message of length $n$ and a message of length $n-1$ to it, but I don't really get what the ...
user avatar
5 votes
2 answers
2k views

Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?

In the answer of the following post: Why was AES CBC removed in TLS 1.3?, I quote the following from the chosen answer: After the Lucky13 attack (a timing oracle caused by MAC-then-encrypt), it ...
user avatar
0 votes
1 answer
230 views

First block as initialization vector in the CBC-MAC

A fixed-length CBC-MAC uses zero block as IV (initialization vector) to prevent from changing the first block. i.e. tag $t$ = $F(m_x \oplus ... F(m_3 \oplus F(m_2 \oplus F(m_1)))...)$ My question is,...
user avatar
  • 509
5 votes
2 answers
2k views

Can AES-CBC be safely used in combination with RSA, or must it be CBC-MAC?

The plan is to encrypt files using an AES-256 in CBC mode secret key. The secret key itself will be encrypted with a RSA 2048-bit public key. Is using AES-CBC sufficiently secure if used in ...
user avatar
4 votes
1 answer
2k views

CBC - Cipher-text stealing decryption

(I asked in stackoverflow and I should ask my question here not there, sorry about that) The graph shows CBC- with cipher-text stealing and (b) is the block length. The output cipher-text is c1,...,...
user avatar
0 votes
1 answer
2k views

MAC size 128 bits or more?

Just a quick question: I've seen implemented BouncyCastle's class AeadParameters with MAC length of 128 bits, which was allegedly recommended. Though when I looked up HMac to implement my own MAC in ...
user avatar
  • 37
2 votes
1 answer
2k views

Why is ECBC-MAC with one key insecure?

For handling variable-length input and having the calculation of the MAC remain online, encrypting the output of CBC-MAC with a second key is recommended. I have not seen it said that a different key ...
user avatar
  • 3,397
0 votes
1 answer
249 views

CBC-MAC 8 octet ICV compatable with 16 octet block size?

I'm trying to use DTLS in Preshared key mode for CoAP which necessitates using CipherSuite TLS_PSK_WITH_AES_128_CCM_8 I'm trying to start with the CBC-MAC but I'm not sure how to get an 8 octet ICV ...
user avatar
0 votes
1 answer
1k views

CMAC Generation : If input payload length is not aligned in 16 bytes, what are the possible side effects?

While searching for answers ,I understand that RFC AES-CMAC 4493 is suggested by NIST to overcome if payload is not aligned in 16 bytes. I would like to know what drawbacks/insecure caused by AES-...
user avatar
  • 243
1 vote
1 answer
1k views

Security of CBC-MAC fixed length with zero padding

I see everywhere that fixed length CBC-MAC should be more or less secure against forgery. But is it really ? Could you forge a message assuming by example that you use CBC-MAC with let's say always ...
user avatar
  • 121
3 votes
1 answer
123 views

Would a simplified CBC-MAC be safe?

Would using the ciphertext of the previous block as key instead of XOR:ing the block and encrypting with the normal key work? Normally it's done like this: What if we instead do this: Seems like it ...
user avatar
  • 145
0 votes
1 answer
945 views

CBC-MAC for Arbitrary Length Messages

Katz/Lindell propose the following modification to the basic CBC-MAC scheme to handle variable length messages (p.125): We sample two uniform independent keys $k_1, k_2\in \{0,1\}^n$. Then to ...
user avatar
3 votes
2 answers
2k views

Having CBC-MAC of a one block message, forge CBC-MAC of two blocks

This whole question pertains to CBC-MAC. Let's say $a$ is one cipher block long, and the attacker knows the MAC $M(a)$ of $a$, which was generated with a random key. How can the attacker forge the ...
user avatar
0 votes
1 answer
128 views

For TLS AES_CCM mode how does CBC_MAC work when the message length is not aligned to block size?

Even after goign through lot of specs I failed to understand how CBC-MAC works, specifically in case we have message not aligned to 16 bytes. Are there any padding bytes?
user avatar
1 vote
1 answer
1k views

CTR and CBC-MAC Demystified

I am trying to understand the background processes within the CCMP. However the concept of CTR and CBC-MAC made me lost. According to the CCMP Encapsulation block diagram there are inputs like ...
user avatar
3 votes
1 answer
244 views

Security proof for CBC as a prefix-free PRF

I am currently trying to fully understand Dan Boneh's/ Victor Shoup's proof in their excellent crypto book draft, that the raw CBC construction is a secure pseudo random function family for prefix-...
user avatar
  • 171
6 votes
1 answer
40k views

Why is padding used in CBC mode?

I am newbie to CBC crypto: When I try decrypt the cipher text to recover the plain text, things are not going smoothly as I face some issues in the decryption process with padding and not obtaining ...
user avatar
  • 243
1 vote
1 answer
412 views

Use of Same Key for CTR and CBC-MAC in CCM Mode of Operation?

The NIST Specification Document for CCM Mode of operation 800-38C states on Page 13 The same key, K, is used for both the CTR and CBC-MAC mechanisms within CCM. is it secure to use same key? or ...
user avatar
  • 1,998
1 vote
0 answers
85 views

Create MAC and IV given known IV and MAC for previous message

I've been given a AES-CBC-MAC, a message and the IV. I don't know the key. Given a second message I am supposed to derive the IV and create a valid MAC. I believe I've successfully created the ...
user avatar
  • 111