Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Cipher Block Chaining MAC (CBC-MAC) is a method of building a message authentication code from a block-cipher.

5
votes
2answers
140 views

Why does the CBC-MAC require PRFs?

I'm stuck on exercise 4.19 from Introduction to Modern Cryptography. Let $F$ be a keyed function that is a secure (deterministic) MAC for messages of length $n$. (Note that $F$ need not be a ...
2
votes
2answers
137 views

The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...
0
votes
0answers
26 views

In terms of confidentiality and integrity, does it matter if we use the same key for encrypt-then-mac? [duplicate]

Suppose we have the same block cipher for both, AES, and same mode of operation, i.e. CBC. I know we are supposed to use $K_1 \neq K_2$, but I have been unable to think of any confidentiality attacks ...
2
votes
1answer
108 views

Real time video stream AES encryption with authentication

I am now studying the AES encryption for real-time video stream. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video encryption and authentication. With MAC authentication, ...
2
votes
0answers
45 views

Modify basic CBC-MAC construction using a keyed function

Typically, CBC-MAC is a secure MAC for fixed length message if the construction uses a pseudorandom function. However, for a secure MAC, we can use a keyed function that is not necessarily ...
3
votes
3answers
580 views

When do I need to use CBC and HMAC?

As I know CBC does not provide integrity for the message, thus HMAC is used to provide integrity for CBC message. Also, I hear about CBC-MAC which can provide integrity and confidentiality. Which one ...
1
vote
1answer
43 views

CCM authenticity bound

Can someone help me understanding the CCM authenticity bound by Phillip Rogaway? i-e Success probability < $q_{\text{dec}}/2^\tau + \sigma/2^b$. $\tau$ is tag length, where as $b$ is block length. ...
0
votes
1answer
70 views

Cipher based message authentication (CMAC) and block reordering

Is Cipher based message authentication (CMAC) susceptible to block reordering (just like CBC)?
3
votes
1answer
50 views

Propagating CBC insecure Authenticated Encryption

why is Propagating CBC (PCBC) insecure for authenticated encryption? I received the hint that I should feed a message of length $n$ and a message of length $n-1$ to it, but I don't really get what the ...
3
votes
2answers
669 views

Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?

In the answer of the following post: Why was AES CBC removed in TLS 1.3?, I quote the following from the chosen answer: After the Lucky13 attack (a timing oracle caused by MAC-then-encrypt), it ...
0
votes
1answer
45 views

First block as initialization vector in the CBC-MAC

A fixed-length CBC-MAC uses zero block as IV (initialization vector) to prevent from changing the first block. i.e. tag $t$ = $F(m_x \oplus ... F(m_3 \oplus F(m_2 \oplus F(m_1)))...)$ My question is,...
5
votes
2answers
338 views

Can AES-CBC be safely used in combination with RSA, or must it be CBC-MAC?

The plan is to encrypt files using an AES-256 in CBC mode secret key. The secret key itself will be encrypted with a RSA 2048-bit public key. Is using AES-CBC sufficiently secure if used in ...
2
votes
1answer
225 views

CBC - Cipher-text stealing decryption

(I asked in stackoverflow and I should ask my question here not there, sorry about that) The graph shows CBC- with cipher-text stealing and (b) is the block length. The output cipher-text is c1,...,...
0
votes
1answer
222 views

MAC size 128 bits or more?

Just a quick question: I've seen implemented BouncyCastle's class AeadParameters with MAC length of 128 bits, which was allegedly recommended. Though when I looked up HMac to implement my own MAC in ...
1
vote
1answer
153 views

Why is ECBC-MAC with one key insecure?

For handling variable-length input and having the calculation of the MAC remain online, encrypting the output of CBC-MAC with a second key is recommended. I have not seen it said that a different key ...
0
votes
1answer
68 views

CBC-MAC 8 octet ICV compatable with 16 octet block size?

I'm trying to use DTLS in Preshared key mode for CoAP which necessitates using CipherSuite TLS_PSK_WITH_AES_128_CCM_8 I'm trying to start with the CBC-MAC but I'm not sure how to get an 8 octet ICV ...
0
votes
1answer
206 views

CMAC Generation : If input payload length is not aligned in 16 bytes, what are the possible side effects?

While searching for answers ,I understand that RFC AES-CMAC 4493 is suggested by NIST to overcome if payload is not aligned in 16 bytes. I would like to know what drawbacks/insecure caused by AES-...
1
vote
1answer
255 views

Security of CBC-MAC fixed length with zero padding

I see everywhere that fixed length CBC-MAC should be more or less secure against forgery. But is it really ? Could you forge a message assuming by example that you use CBC-MAC with let's say always ...
0
votes
0answers
56 views

how to use CBC-MAC to ensure both integrity and authentication?

If I used the CBC mode to encrypt and decrypt (n) blocks how can I use CBC-MAC to ensure both integrity and the authentication, I know how to use it for authentication only but what if I want to use ...
2
votes
1answer
65 views

Would a simplified CBC-MAC be safe?

Would using the ciphertext of the previous block as key instead of XOR:ing the block and encrypting with the normal key work? Normally it's done like this: What if we instead do this: Seems like it ...
0
votes
1answer
182 views

CBC-MAC for Arbitrary Length Messages

Katz/Lindell propose the following modification to the basic CBC-MAC scheme to handle variable length messages (p.125): We sample two uniform independent keys $k_1, k_2\in \{0,1\}^n$. Then to ...
0
votes
0answers
147 views

CBC-MAC with a constant key

What affect does having a constant key have on a CBC-MAC algorithm and how would it make the CBC-MAC not pre-image resistant.
1
vote
2answers
535 views

Having CBC-MAC of a one block message, forge CBC-MAC of two blocks

This whole question pertains to CBC-MAC. Let's say $a$ is one cipher block long, and the attacker knows the MAC $M(a)$ of $a$, which was generated with a random key. How can the attacker forge the ...
0
votes
1answer
76 views

For TLS AES_CCM mode how does CBC_MAC work when the message length is not aligned to block size?

Even after goign through lot of specs I failed to understand how CBC-MAC works, specifically in case we have message not aligned to 16 bytes. Are there any padding bytes?
0
votes
1answer
504 views

CTR and CBC-MAC Demystified

I am trying to understand the background processes within the CCMP. However the concept of CTR and CBC-MAC made me lost. According to the CCMP Encapsulation block diagram there are inputs like ...
0
votes
0answers
42 views

From block-wise Universal Hash Function to bit-wise UHF

Let's assume we have an $\epsilon$-bounded Universal Hash Function Family $H = \{H_K:\mathcal{X}^{\leq m}\rightarrow \mathcal{X}\mid \forall K\in \mathcal{K}\}$ with $\mathcal{X} = \mathcal{K} = \{0,1\...
3
votes
1answer
114 views

Security proof for CBC as a prefix-free PRF

I am currently trying to fully understand Dan Boneh's/ Victor Shoup's proof in their excellent crypto book draft, that the raw CBC construction is a secure pseudo random function family for prefix-...
2
votes
1answer
10k views

Why is padding used in CBC mode?

I am newbie to CBC crypto: When I try decrypt the cipher text to recover the plain text, things are not going smoothly as I face some issues in the decryption process with padding and not obtaining ...
1
vote
1answer
177 views

Use of Same Key for CTR and CBC-MAC in CCM Mode of Operation?

The NIST Specification Document for CCM Mode of operation 800-38C states on Page 13 The same key, K, is used for both the CTR and CBC-MAC mechanisms within CCM. is it secure to use same key? or ...
1
vote
0answers
57 views

Create MAC and IV given known IV and MAC for previous message

I've been given a AES-CBC-MAC, a message and the IV. I don't know the key. Given a second message I am supposed to derive the IV and create a valid MAC. I believe I've successfully created the ...
9
votes
2answers
2k views

What is the correct way to implement PBKDF2 + AES CBC + HMAC?

I've been doing a lot of reading on the proper way to implement AES CBC mode with HMAC authentication. I've seen many explanations, however, I've had a hard time finding an actual real example (with ...
0
votes
1answer
257 views

Enc-Mac (AES CTR+CBC) mixing AES-256 and AES-128 and splitting keys

I'm looking to accomplish a Enc-then-Mac approach using AES-CTR and ECBC-MAC Now ECBC-MAC requires 2 distinct keys, one for the MAC, and one to encrypt the Tag. If I do this: Use AES256-CTR for the ...
0
votes
1answer
139 views

Dependent keys on Encrypt Then MAC

It is generally bad form to reuse the same key for encryption and authentication in an "encrypt then MAC" scheme. For example, in the naive encrypt then MAC scheme, we use a randomized CBC block ...
4
votes
2answers
218 views

How does encrypt-then-MAC protect from CCA?

I am an application developer, implementing client-side crypto to protect data that is then transmitted to be stored on a server. The application uses AES with CBC mode with a resulting encrypt-then-...
3
votes
1answer
162 views

CBC Padding Oracle in SSL3. Why only in SSL3 not in TLS1,TLS1.1, etc

I read about PODDLE attack which downgrades the TLS version to SSL 3.0 to exploit CBC padding oracle attack. I looked at the specs for TLS 1.1 And found CBC is still used in its ciphersuites. Why is ...
2
votes
1answer
594 views

CBC-MAC insecure with random IV

From the paper [1] My question is how is the tag $(m,t)$ a valid forgery. This is my understanding: If I used numbers so $m=101, IV=110, m\oplus IV=011$, but the forgery says that I can use m, so ...
3
votes
0answers
84 views

Authenticated Encryption CCM encrypt MAC

Suppose I have Encryption in CTR-Mode and a CBC-MAC. Why should I also encrypt the MAC? In the documentation of NIST stands: "By encrypting T we avoid CBC-MAC collision attacks". But I can not ...
0
votes
1answer
434 views

Forge CBC-MAC by creating new message, giving the MAC of two messages

The question is quite similar to this one : Forge CBC-MAC given the MAC of two messages and of their concatenation But i still cannot fully understand it, and here's my question: giving two messages ...
0
votes
1answer
167 views

Can a block cipher be used to encrypt wireless communications?

Would it be possible to use a block cipher such as CBC in order to encrypt a wireless communication? For example, could I use CBC-MAC, on each block, for encryption for WiFi?
1
vote
1answer
963 views

What's the reason why CBC-MAC shouldn't use IV or random IV?

I searched the answer but I'm not sure if I understood exactly, and have some other questions. I understood that the reason for CBC-MAC not to have random IV is if CBC-MAC has a random IV, the ...
2
votes
1answer
239 views

encryption of digest of unkeyed hash function is susceptible to forgery?

I have a question in mind. Suppose we have a collision-resistant unkeyed-hash function $H(·)$ which outputs a 128-bit digest, and a semantic secure symmetric encryption $E(·,·)$ in the following way, ...
2
votes
1answer
1k views

HMAC vs CMAC, which is faster?

I want to know which is faster-HMAC or CMAC.I know CMAC is based on block cipher encryption,where output of each block is X-OR with the next plain text block. If security is not a concern,which will ...
3
votes
1answer
2k views

Insecurity of CBC-MAC

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Such as the highlighted parts in previous pictures Questions: why ...
4
votes
1answer
94 views

Do you need a HMAC if decryption attempts are severely limited?

I am considering an application where data bandwidth is extremely limited, and considering removing message authentication codes from encrypted transmissions. The encryption method is currently AES-...
3
votes
2answers
789 views

Why can't we use the first block of AES-CBC as MAC

As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?
4
votes
0answers
114 views

Does length prepending fix the key reuse problems with CBC and CBC-MAC?

As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea. Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
8
votes
1answer
688 views

Security of a simple AEAD construction

Introduction I want securely communicate with a small 8-bit device which has a very limited program program memory (Arduino Uno - 32K). My goal is to minimize code size and RAM usage. There are ...
0
votes
1answer
64 views

Proper authenticated encryption

I am using AES-CBC, authenticating using HMAC-SHA512 and I was wondering whether my thought process and implementation are correct. The message send over the network is: HMAC(64Bytes),IV(16Bytes),...
2
votes
2answers
725 views

How to show that this modification of CBC-MAC is insecure?

I'm working on some cryptography problems, found this and I'm not sure how to solve it: Modify CBC-MAC so that all blocks $t_1,\dots,t_l$ are output rather than just $t_l$ and prove it is not ...
5
votes
2answers
697 views

Is reusing keys for CBC and CBC-MAC secure when using encrypt-then-MAC?

I know reusing keys is a bad idea, especially for CBC and CBC-MAC, but the example for why on Wikipedia seemed to use encrypt-and-MAC. It seems obvious that the last block of encryption will be equal ...