Questions tagged [cbc-mac]

Cipher Block Chaining MAC (CBC-MAC) is a method of building a message authentication code from a block-cipher.

Filter by
Sorted by
Tagged with
-1
votes
0answers
31 views

I want to learn more about the AMAC algorithm!

I want to learn more about the AMAC algorithm. But, I can't understand AMAC algorithm. Please show in diagram.
1
vote
1answer
32 views

XCBC Authentication

So XCBC was made to counteract lengths attacks against CBC-MAC, but how exactly does the modification made defeat this attack? All I can find are a few papers on why 2-key XCBC isn't actually secure.
0
votes
0answers
22 views

CBC-MAC padded message difference [duplicate]

If an attacker had a padded message and its corresponding CBC-MAC tag, how would they construct another message which produces the same tag for the same key as the original? The padding scheme used in ...
0
votes
0answers
100 views

Preimage attack on cbc-mac with constant key

Is a hash function created by using CBC-MAC with one public key that does not change secure against preimage attacks? If not, how could you exploit this to find a single block message that hashes to a ...
1
vote
0answers
142 views

CBC-MAC Padding weaknesses

I'm trying to wrap my head around how different padding methods affect the strength of CBC-MAC's. Suppose a message is split into different blocks, m1, m2, m3 etc. and the last block is padded with 0'...
3
votes
0answers
66 views

What was used for symmetric message authentication before HMAC was invented?

Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else? I know about NIST FIPS 113 "Data Authentication Algorithm" ...
0
votes
0answers
29 views

CBC MAC attack using Arbitrary-length Messages [duplicate]

This is from a lecture : The adversary sees the message-tag pair(m,τ), where m= (m1,m2,...,mn)The adversary sees the message-tag pair(m′,τ′), where m′= (m′1,m′2,...,m′n)The adversary computes m''=(m1,...
1
vote
1answer
86 views

Why CBC-MAC encrypts at each step

Considering CBC-MAC as: $\qquad H_0 = IV = 0$ $\qquad H_i = E_k(P_i \oplus H_{i-1})$ $\qquad MAC = H_n$ What are the properties that makes this "safer" (less ...
1
vote
0answers
176 views

Show that the CBC-MAC construction applied to a PRP is not collision resistant

I'm trying answer the following question. Yes, it is a homework question, so I'm not asking for the answer directly but would like to get some pointers on how to solve it. So far I have spent several ...
6
votes
2answers
386 views

Why does the CBC-MAC require PRFs?

I'm stuck on exercise 4.19 from Introduction to Modern Cryptography. Let $F$ be a keyed function that is a secure (deterministic) MAC for messages of length $n$. (Note that $F$ need not be a ...
2
votes
2answers
803 views

The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page: The attacks involve detecting small differences in the time at which TLS error messages ...
3
votes
1answer
652 views

Real time video stream AES encryption with authentication

I am now studying AES encryption for real-time video streaming. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video encryption and authentication. With MAC authentication, ...
2
votes
0answers
65 views

Modify basic CBC-MAC construction using a keyed function

Typically, CBC-MAC is a secure MAC for fixed length message if the construction uses a pseudorandom function. However, for a secure MAC, we can use a keyed function that is not necessarily ...
3
votes
3answers
2k views

When do I need to use CBC and HMAC?

As I know CBC does not provide integrity for the message, thus HMAC is used to provide integrity for CBC message. Also, I hear about CBC-MAC which can provide integrity and confidentiality. Which one ...
1
vote
1answer
71 views

CCM authenticity bound

Can someone help me understanding the CCM authenticity bound by Phillip Rogaway? i-e Success probability < $q_{\text{dec}}/2^\tau + \sigma/2^b$. $\tau$ is tag length, where as $b$ is block length. ...
0
votes
1answer
173 views

Cipher based message authentication (CMAC) and block reordering

Is Cipher based message authentication (CMAC) susceptible to block reordering (just like CBC)?
3
votes
1answer
97 views

Propagating CBC insecure Authenticated Encryption

why is Propagating CBC (PCBC) insecure for authenticated encryption? I received the hint that I should feed a message of length $n$ and a message of length $n-1$ to it, but I don't really get what the ...
3
votes
2answers
2k views

Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?

In the answer of the following post: Why was AES CBC removed in TLS 1.3?, I quote the following from the chosen answer: After the Lucky13 attack (a timing oracle caused by MAC-then-encrypt), it ...
0
votes
1answer
147 views

First block as initialization vector in the CBC-MAC

A fixed-length CBC-MAC uses zero block as IV (initialization vector) to prevent from changing the first block. i.e. tag $t$ = $F(m_x \oplus ... F(m_3 \oplus F(m_2 \oplus F(m_1)))...)$ My question is,...
5
votes
2answers
1k views

Can AES-CBC be safely used in combination with RSA, or must it be CBC-MAC?

The plan is to encrypt files using an AES-256 in CBC mode secret key. The secret key itself will be encrypted with a RSA 2048-bit public key. Is using AES-CBC sufficiently secure if used in ...
3
votes
1answer
754 views

CBC - Cipher-text stealing decryption

(I asked in stackoverflow and I should ask my question here not there, sorry about that) The graph shows CBC- with cipher-text stealing and (b) is the block length. The output cipher-text is c1,...,...
0
votes
1answer
682 views

MAC size 128 bits or more?

Just a quick question: I've seen implemented BouncyCastle's class AeadParameters with MAC length of 128 bits, which was allegedly recommended. Though when I looked up HMac to implement my own MAC in ...
2
votes
1answer
525 views

Why is ECBC-MAC with one key insecure?

For handling variable-length input and having the calculation of the MAC remain online, encrypting the output of CBC-MAC with a second key is recommended. I have not seen it said that a different key ...
0
votes
1answer
143 views

CBC-MAC 8 octet ICV compatable with 16 octet block size?

I'm trying to use DTLS in Preshared key mode for CoAP which necessitates using CipherSuite TLS_PSK_WITH_AES_128_CCM_8 I'm trying to start with the CBC-MAC but I'm not sure how to get an 8 octet ICV ...
0
votes
1answer
551 views

CMAC Generation : If input payload length is not aligned in 16 bytes, what are the possible side effects?

While searching for answers ,I understand that RFC AES-CMAC 4493 is suggested by NIST to overcome if payload is not aligned in 16 bytes. I would like to know what drawbacks/insecure caused by AES-...
1
vote
1answer
516 views

Security of CBC-MAC fixed length with zero padding

I see everywhere that fixed length CBC-MAC should be more or less secure against forgery. But is it really ? Could you forge a message assuming by example that you use CBC-MAC with let's say always ...
2
votes
1answer
85 views

Would a simplified CBC-MAC be safe?

Would using the ciphertext of the previous block as key instead of XOR:ing the block and encrypting with the normal key work? Normally it's done like this: What if we instead do this: Seems like it ...
0
votes
1answer
327 views

CBC-MAC for Arbitrary Length Messages

Katz/Lindell propose the following modification to the basic CBC-MAC scheme to handle variable length messages (p.125): We sample two uniform independent keys $k_1, k_2\in \{0,1\}^n$. Then to ...
1
vote
2answers
1k views

Having CBC-MAC of a one block message, forge CBC-MAC of two blocks

This whole question pertains to CBC-MAC. Let's say $a$ is one cipher block long, and the attacker knows the MAC $M(a)$ of $a$, which was generated with a random key. How can the attacker forge the ...
0
votes
1answer
103 views

For TLS AES_CCM mode how does CBC_MAC work when the message length is not aligned to block size?

Even after goign through lot of specs I failed to understand how CBC-MAC works, specifically in case we have message not aligned to 16 bytes. Are there any padding bytes?
1
vote
1answer
871 views

CTR and CBC-MAC Demystified

I am trying to understand the background processes within the CCMP. However the concept of CTR and CBC-MAC made me lost. According to the CCMP Encapsulation block diagram there are inputs like ...
3
votes
1answer
167 views

Security proof for CBC as a prefix-free PRF

I am currently trying to fully understand Dan Boneh's/ Victor Shoup's proof in their excellent crypto book draft, that the raw CBC construction is a secure pseudo random function family for prefix-...
4
votes
1answer
21k views

Why is padding used in CBC mode?

I am newbie to CBC crypto: When I try decrypt the cipher text to recover the plain text, things are not going smoothly as I face some issues in the decryption process with padding and not obtaining ...
1
vote
1answer
288 views

Use of Same Key for CTR and CBC-MAC in CCM Mode of Operation?

The NIST Specification Document for CCM Mode of operation 800-38C states on Page 13 The same key, K, is used for both the CTR and CBC-MAC mechanisms within CCM. is it secure to use same key? or ...
1
vote
0answers
71 views

Create MAC and IV given known IV and MAC for previous message

I've been given a AES-CBC-MAC, a message and the IV. I don't know the key. Given a second message I am supposed to derive the IV and create a valid MAC. I believe I've successfully created the ...
10
votes
2answers
4k views

What is the correct way to implement PBKDF2 + AES CBC + HMAC?

I've been doing a lot of reading on the proper way to implement AES CBC mode with HMAC authentication. I've seen many explanations, however, I've had a hard time finding an actual real example (with ...
0
votes
1answer
399 views

Enc-Mac (AES CTR+CBC) mixing AES-256 and AES-128 and splitting keys

I'm looking to accomplish a Enc-then-Mac approach using AES-CTR and ECBC-MAC Now ECBC-MAC requires 2 distinct keys, one for the MAC, and one to encrypt the Tag. If I do this: Use AES256-CTR for the ...
0
votes
1answer
185 views

Dependent keys on Encrypt Then MAC

It is generally bad form to reuse the same key for encryption and authentication in an "encrypt then MAC" scheme. For example, in the naive encrypt then MAC scheme, we use a randomized CBC block ...
3
votes
2answers
428 views

How does encrypt-then-MAC protect from CCA?

I am an application developer, implementing client-side crypto to protect data that is then transmitted to be stored on a server. The application uses AES with CBC mode with a resulting encrypt-then-...
2
votes
1answer
260 views

CBC Padding Oracle in SSL3. Why only in SSL3 not in TLS1,TLS1.1, etc

I read about PODDLE attack which downgrades the TLS version to SSL 3.0 to exploit CBC padding oracle attack. I looked at the specs for TLS 1.1 And found CBC is still used in its ciphersuites. Why is ...
2
votes
2answers
1k views

CBC-MAC insecure with random IV

Prove that the following modification of $\operatorname{CBC-MAC}$ does not yield a secure fixed-length $\operatorname{MAC}$: Modify $\operatorname{CBC-MAC}$ so that a random $IV$ is used each time a ...
2
votes
1answer
142 views

Why does the authenticated cipher CCM encrypt the MAC too?

Suppose I have Encryption in CTR-Mode and a CBC-MAC. Why should I also encrypt the MAC? In the documentation of NIST stands: "By encrypting T we avoid CBC-MAC collision attacks". But I can not ...
1
vote
1answer
745 views

Forge CBC-MAC by creating new message, giving the MAC of two messages

The question is quite similar to this one : Forge CBC-MAC given the MAC of two messages and of their concatenation But i still cannot fully understand it, and here's my question: giving two messages ...
0
votes
1answer
243 views

Can a block cipher be used to encrypt wireless communications?

Would it be possible to use a block cipher such as CBC in order to encrypt a wireless communication? For example, could I use CBC-MAC, on each block, for encryption for WiFi?
1
vote
1answer
1k views

What's the reason why CBC-MAC shouldn't use IV or random IV?

I searched the answer but I'm not sure if I understood exactly, and have some other questions. I understood that the reason for CBC-MAC not to have random IV is if CBC-MAC has a random IV, the ...
2
votes
1answer
262 views

encryption of digest of unkeyed hash function is susceptible to forgery?

I have a question in mind. Suppose we have a collision-resistant unkeyed-hash function $H(·)$ which outputs a 128-bit digest, and a semantic secure symmetric encryption $E(·,·)$ in the following way, ...
2
votes
1answer
2k views

HMAC vs CMAC, which is faster?

I want to know which is faster-HMAC or CMAC.I know CMAC is based on block cipher encryption,where output of each block is X-OR with the next plain text block. If security is not a concern,which will ...
4
votes
1answer
4k views

Insecurity of CBC-MAC

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Such as the highlighted parts in previous pictures Questions: why ...
3
votes
1answer
117 views

Do you need a HMAC if decryption attempts are severely limited?

I am considering an application where data bandwidth is extremely limited, and considering removing message authentication codes from encrypted transmissions. The encryption method is currently AES-...
3
votes
2answers
847 views

Why can't we use the first block of AES-CBC as MAC

As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?