Skip to main content

Questions tagged [cbc-mac]

Cipher Block Chaining MAC (CBC-MAC) is a method of building a message authentication code from a block-cipher.

Filter by
Sorted by
Tagged with
2 votes
0 answers
53 views

Producing existential forgery against CBC-MAC

Given the above MAC scheme, I want to ask how to form existential forgery of this scheme? I have looked through a couple explanations on existential forgery but still struggle understanding the ...
b1841837's user avatar
3 votes
1 answer
111 views

Understanding CBC-MAC Algorithm and Nested Encryption

In the CBC-MAC algorithm as given in the image below, I have two questions: It is said that the CBC-MAC is simply the last block of ciphertext if the message is encrypted using CBC block cipher mode, ...
revision's user avatar
1 vote
1 answer
98 views

Putty PPK Encryption Questions (or AES-CBC)

I am learning about aes-cbc and to simplify things we need two parameters for encryption and randomness (key and IV). IV is random at runtime and will be used to randomize the first cipherblock which ...
0xab3d's user avatar
  • 123
0 votes
2 answers
271 views

Rate the security of the following MAC

Ok we know when we add a random IV in our "modified encrypted" MAC became useless and the IV can be forgery, then our encryption scheme becomes vulnerable to chosen plaintext attacks. ...
Poseid0n's user avatar
0 votes
1 answer
367 views

Given the CBC-MAC for a message M and the key K, How could I forge a new message M' so that it has the same CBC-Mac as M

Im looking to learn about forging CBC-Macs. Given the CBC-Mac for a Message M and the Key used to encrypt the message K. Can I create a new message M' which would have the same CBC-MAC? Original ...
Tom Scott's user avatar
0 votes
1 answer
1k views

CBC-MAC Forge Attack Question

I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
CryptoGuru's user avatar
0 votes
1 answer
1k views

What is the use of Additional data or associated data in AESGcm. How it is used while encryption and decryption [closed]

I am trying to understand the AESGcm encryption and decryption and there's one field associated data in Encryption and Decryption methods. https://learn.microsoft.com/en-us/dotnet/api/system.security....
Captain_Levi's user avatar
1 vote
0 answers
131 views

CBC MAC forgery [duplicate]

$\text{CBC-MAC}$ is defined as follows: $\text{CBC-MAC}_k() = IV $ $\text{CBC-MAC}_k(m_1, . . . , m_n) = E_k(m_n \oplus \text{CBC-MAC}_k(m_1, . . . , m_{n−1}))$ My lecture notes say that this is ...
SVMteamsTool's user avatar
1 vote
2 answers
374 views

changing messages for authentication without the tag changed. (CBC-MAC)

do you know about CBC-MAC? I have iv ,MAC and Transaction but no key. and I should change Transaction without change cipher text. do you know how this is possible at all? In addition, I do not have ...
fatima's user avatar
  • 21
3 votes
1 answer
432 views

Why a hash function in a manner similar to CBC-MAC is not collision-resistant?

I'm reading the book The Joy of Cryptography by Mike Rosulek. When reading Chapter 11, on the hash function, I found a very interesting exercise. Does anyone have ideas on how to prove this? Please ...
user avatar
3 votes
1 answer
178 views

Why does CBC-MAC(M) = CFB-MAC(M)?

I don't understand why $\text{CBC-MAC}(M) = \text{CFB-MAC}(M)$. Has it something to do with $\text{CBC-MAC}(M) = C_L$ and $\text{CFB-MAC}(M) = E_K(C'_{L-1})$?
user97599's user avatar
2 votes
1 answer
168 views

Is the tag generated in MAC equal for equal messages in CBC-MAC?

The Cipher Block Chaining algorithm for generating message authentication codes uses a 0 IV . So my understanding is that same messages will generate same MACs which seems to violate semantic ...
Abhisek Dash's user avatar
1 vote
1 answer
431 views

Finding IV for forgery of AES CBC-MAC with non-fixed IV

As CBC mode might do several rounds, how it could be possible to find another IV for forgery attack? This is an example from my course: Assume you receive a pair with the plaintext $P_1$ and its MAC ...
Carter's user avatar
  • 13
1 vote
0 answers
111 views

Insecure pseudo random functions

Let $F$ be a pseudo-random function. Show that the following constructions are insecure as message authentication codes (in each case $K \in \{0,1\}^n$ is the private key): $(a)$ To authenticate a ...
Sayantan's user avatar
0 votes
1 answer
483 views

Attacks on the RawCBC-MAC if the final step of encrypting with a second key isn't done

This is from Boneh's lecture ECBC-MAC Here is also a link to the lecture itself - https://www.coursera.org/learn/crypto/lecture/QYT6i/cbc-mac-and-nmac CBC-MAC with $(K_1, K_2)$ on a message $M$ ...
user93353's user avatar
  • 2,245
10 votes
0 answers
213 views

Do CCM and EAX provide key commitment?

In an interesting paper called "Partitioning Oracle Attacks" by Julia Len, Paul Grubbs & Thomas Ristenpart an attack is presented on 1.5 pass AEAD schemes that utilize GMAC (GCM, AES-GCM,...
Maarten Bodewes's user avatar
  • 93.2k
1 vote
1 answer
193 views

Is it safe to use the CBC-MAC as a Initial Vector and Key Check Value in deterministic encryption?

I want to deterministically encrypt a short message <50 bytes with AES-128 CBC. I also want to be able to detect if the correct key is being used. Ciphertext and IV integrity will be guaranteed by ...
Vincent007's user avatar
1 vote
0 answers
324 views

CBC-MAC variable-length weakness with MAC size greater than the encryption block size

The title mostly explains it; CBC-MAC variable-length weakness with MAC size greater than the encryption block size I've seen that by having the pairs $(M,T_m)$ and $(N,T_n)$, we can generate a ...
Ben's user avatar
  • 11
-1 votes
1 answer
107 views

what are the things that aes cbc-mac , aes cmac guarantees?

does aes-cbc-mac guarantees integrity, authenticity and confidentiality? does aes-cmac guarantees integrity, authenticity and confidentiality? because I only know that aes-ccm guarantees all i.e. ...
wanglen soram's user avatar
0 votes
1 answer
1k views

What will be the MAC size of AES CBC-MAC if there are suppose 10 blocks in the AES CBC-MAC?

What will be the mac size of AES CBC-MAC if there are suppose 10 blocks in the AES CBC-MAC? Will it always be 128 bits MAC size for no matter how many numbers of blocks?
wanglen soram's user avatar
0 votes
2 answers
425 views

Showing a CBC-MAC is not preimage resistant with a proof

So hypothetically I have a an arbitrary block cipher operating in CBC-MAC mode that makes use of a public and static $IV$ as well as a static key $K$. I want to be able to that this won't be preimage ...
gigaman76543's user avatar
5 votes
1 answer
1k views

CBC encryption + CBC MAC reusing key in MAC-then-Encrypt

I'm reading the Handbook of Applied Cryptography by ‎Alfred J. Menezes et al. Especially, I'm stuck with the case that reusing key for CBC encryption and CBC-MAC in MAC-then-encrypt structure. My ...
pioneer's user avatar
  • 325
1 vote
1 answer
438 views

XCBC Authentication

So XCBC was made to counteract lengths attacks against CBC-MAC, but how exactly does the modification made defeat this attack? All I can find are a few papers on why 2-key XCBC isn't actually secure.
Anan's user avatar
  • 65
0 votes
0 answers
33 views

CBC-MAC padded message difference [duplicate]

If an attacker had a padded message and its corresponding CBC-MAC tag, how would they construct another message which produces the same tag for the same key as the original? The padding scheme used in ...
Kabiru's user avatar
  • 1
0 votes
0 answers
560 views

Preimage attack on cbc-mac with constant key

Is a hash function created by using CBC-MAC with one public key that does not change secure against preimage attacks? If not, how could you exploit this to find a single block message that hashes to a ...
sharkyxy's user avatar
1 vote
0 answers
795 views

CBC-MAC Padding weaknesses

I'm trying to wrap my head around how different padding methods affect the strength of CBC-MAC's. Suppose a message is split into different blocks, m1, m2, m3 etc. and the last block is padded with 0'...
sharkyxy's user avatar
3 votes
0 answers
94 views

What was used for symmetric message authentication before HMAC was invented?

Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else? I know about NIST FIPS 113 "Data Authentication Algorithm" ...
Z.T.'s user avatar
  • 824
0 votes
0 answers
39 views

CBC MAC attack using Arbitrary-length Messages [duplicate]

This is from a lecture : The adversary sees the message-tag pair(m,τ), where m= (m1,m2,...,mn)The adversary sees the message-tag pair(m′,τ′), where m′= (m′1,m′2,...,m′n)The adversary computes m''=(m1,...
Kivi's user avatar
  • 1
1 vote
1 answer
165 views

Why CBC-MAC encrypts at each step

Considering CBC-MAC as: $\qquad H_0 = IV = 0$ $\qquad H_i = E_k(P_i \oplus H_{i-1})$ $\qquad MAC = H_n$ What are the properties that makes this "safer" (less ...
user1156544's user avatar
1 vote
0 answers
607 views

Show that the CBC-MAC construction applied to a PRP is not collision resistant

I'm trying answer the following question. Yes, it is a homework question, so I'm not asking for the answer directly but would like to get some pointers on how to solve it. So far I have spent several ...
Jonathan Harvey's user avatar
7 votes
2 answers
1k views

Why does the CBC-MAC require PRFs?

I'm stuck on exercise 4.19 from Introduction to Modern Cryptography. Let $F$ be a keyed function that is a secure (deterministic) MAC for messages of length $n$. (Note that $F$ need not be a ...
ambiso's user avatar
  • 706
2 votes
2 answers
1k views

The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...
user9371654's user avatar
4 votes
1 answer
3k views

Real time video stream AES encryption with authentication

I am now studying AES encryption for real-time video streaming. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video encryption and authentication. With MAC authentication, ...
Lenny_W's user avatar
  • 41
2 votes
0 answers
85 views

Modify basic CBC-MAC construction using a keyed function

Typically, CBC-MAC is a secure MAC for fixed length message if the construction uses a pseudorandom function. However, for a secure MAC, we can use a keyed function that is not necessarily ...
Zhiyong's user avatar
  • 53
5 votes
3 answers
7k views

When do I need to use CBC and HMAC?

As I know CBC does not provide integrity for the message, thus HMAC is used to provide integrity for CBC message. Also, I hear about CBC-MAC which can provide integrity and confidentiality. Which one ...
Aymn Alaney's user avatar
1 vote
1 answer
96 views

CCM authenticity bound

Can someone help me understanding the CCM authenticity bound by Phillip Rogaway? i-e Success probability < $q_{\text{dec}}/2^\tau + \sigma/2^b$. $\tau$ is tag length, where as $b$ is block length. ...
WBAN_crypto's user avatar
0 votes
1 answer
285 views

Cipher based message authentication (CMAC) and block reordering

Is Cipher based message authentication (CMAC) susceptible to block reordering (just like CBC)?
user2896215's user avatar
3 votes
1 answer
237 views

Propagating CBC insecure Authenticated Encryption

why is Propagating CBC (PCBC) insecure for authenticated encryption? I received the hint that I should feed a message of length $n$ and a message of length $n-1$ to it, but I don't really get what the ...
Digimon Kaiser's user avatar
5 votes
2 answers
3k views

Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?

In the answer of the following post: Why was AES CBC removed in TLS 1.3?, I quote the following from the chosen answer: After the Lucky13 attack (a timing oracle caused by MAC-then-encrypt), it ...
user9371654's user avatar
0 votes
1 answer
288 views

First block as initialization vector in the CBC-MAC

A fixed-length CBC-MAC uses zero block as IV (initialization vector) to prevent from changing the first block. i.e. tag $t$ = $F(m_x \oplus ... F(m_3 \oplus F(m_2 \oplus F(m_1)))...)$ My question is,...
takita's user avatar
  • 509
5 votes
2 answers
3k views

Can AES-CBC be safely used in combination with RSA, or must it be CBC-MAC?

The plan is to encrypt files using an AES-256 in CBC mode secret key. The secret key itself will be encrypted with a RSA 2048-bit public key. Is using AES-CBC sufficiently secure if used in ...
DedCrypto's user avatar
4 votes
1 answer
2k views

CBC - Cipher-text stealing decryption

(I asked in stackoverflow and I should ask my question here not there, sorry about that) The graph shows CBC- with cipher-text stealing and (b) is the block length. The output cipher-text is c1,...,...
user8863554's user avatar
0 votes
1 answer
2k views

MAC size 128 bits or more?

Just a quick question: I've seen implemented BouncyCastle's class AeadParameters with MAC length of 128 bits, which was allegedly recommended. Though when I looked up HMac to implement my own MAC in ...
daralim's user avatar
  • 37
2 votes
1 answer
2k views

Why is ECBC-MAC with one key insecure?

For handling variable-length input and having the calculation of the MAC remain online, encrypting the output of CBC-MAC with a second key is recommended. I have not seen it said that a different key ...
Melab's user avatar
  • 3,655
0 votes
1 answer
334 views

CBC-MAC 8 octet ICV compatable with 16 octet block size?

I'm trying to use DTLS in Preshared key mode for CoAP which necessitates using CipherSuite TLS_PSK_WITH_AES_128_CCM_8 I'm trying to start with the CBC-MAC but I'm not sure how to get an 8 octet ICV ...
lancegerday's user avatar
0 votes
1 answer
2k views

CMAC Generation : If input payload length is not aligned in 16 bytes, what are the possible side effects?

While searching for answers ,I understand that RFC AES-CMAC 4493 is suggested by NIST to overcome if payload is not aligned in 16 bytes. I would like to know what drawbacks/insecure caused by AES-...
danny's user avatar
  • 253
1 vote
1 answer
2k views

Security of CBC-MAC fixed length with zero padding

I see everywhere that fixed length CBC-MAC should be more or less secure against forgery. But is it really ? Could you forge a message assuming by example that you use CBC-MAC with let's say always ...
user51428's user avatar
  • 121
3 votes
1 answer
154 views

Would a simplified CBC-MAC be safe?

Would using the ciphertext of the previous block as key instead of XOR:ing the block and encrypting with the normal key work? Normally it's done like this: What if we instead do this: Seems like it ...
m_eiman's user avatar
  • 145
0 votes
1 answer
1k views

CBC-MAC for Arbitrary Length Messages

Katz/Lindell propose the following modification to the basic CBC-MAC scheme to handle variable length messages (p.125): We sample two uniform independent keys $k_1, k_2\in \{0,1\}^n$. Then to ...
CRYPTONEWBIE's user avatar
4 votes
1 answer
3k views

Having CBC-MAC of a one block message, forge CBC-MAC of two blocks

This whole question pertains to CBC-MAC. Let's say $a$ is one cipher block long, and the attacker knows the MAC $M(a)$ of $a$, which was generated with a random key. How can the attacker forge the ...
Blondomo's user avatar