Questions tagged [cbc-mac]
Cipher Block Chaining MAC (CBC-MAC) is a method of building a message authentication code from a block-cipher.
111
questions
0
votes
1
answer
243
views
Given the CBC-MAC for a message M and the key K, How could I forge a new message M' so that it has the same CBC-Mac as M
Im looking to learn about forging CBC-Macs.
Given the CBC-Mac for a Message M and the Key used to encrypt the message K.
Can I create a new message M' which would have the same CBC-MAC?
Original ...
0
votes
0
answers
98
views
How to conduct a forgery attack on a CBC-MAC algorithm, given a n block plaintext message T and its corresponding MAC M? [duplicate]
I'm trying to carry out a forgery attack on a CBC-MAC algorithm that automatically pads the message.
I have a 5-block message T, consisting of T1, T2, T3, T4 and T5 and its corresponding MAC M. The ...
0
votes
1
answer
759
views
CBC-MAC Forge Attack Question
I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
- 151
0
votes
1
answer
447
views
What is the use of Additional data or associated data in AESGcm. How it is used while encryption and decryption [closed]
I am trying to understand the AESGcm encryption and decryption and there's one field associated data in Encryption and Decryption methods.
https://learn.microsoft.com/en-us/dotnet/api/system.security....
1
vote
0
answers
127
views
CBC MAC forgery [duplicate]
$\text{CBC-MAC}$ is defined as follows:
$\text{CBC-MAC}_k() = IV $
$\text{CBC-MAC}_k(m_1, . . . , m_n) = E_k(m_n \oplus \text{CBC-MAC}_k(m_1, . . . , m_{n−1}))$
My lecture notes say that this is ...
- 151
1
vote
2
answers
307
views
changing messages for authentication without the tag changed. (CBC-MAC)
do you know about CBC-MAC? I have iv ,MAC and Transaction but no key. and I should change Transaction without change cipher text. do you know how this is possible at all? In addition, I do not have ...
- 21
3
votes
1
answer
329
views
Why a hash function in a manner similar to CBC-MAC is not collision-resistant?
I'm reading the book The Joy of Cryptography by Mike Rosulek.
When reading Chapter 11, on the hash function, I found a very interesting exercise. Does anyone have ideas on how to prove this?
Please ...
user99141
3
votes
1
answer
149
views
Why does CBC-MAC(M) = CFB-MAC(M)?
I don't understand why $\text{CBC-MAC}(M) = \text{CFB-MAC}(M)$. Has it something to do with $\text{CBC-MAC}(M) = C_L$ and $\text{CFB-MAC}(M) = E_K(C'_{L-1})$?
- 31
2
votes
1
answer
132
views
Is the tag generated in MAC equal for equal messages in CBC-MAC?
The Cipher Block Chaining algorithm for generating message authentication codes uses a 0 IV . So my understanding is that same messages will generate same MACs which seems to violate semantic ...
- 69
1
vote
1
answer
283
views
Finding IV for forgery of AES CBC-MAC with non-fixed IV
As CBC mode might do several rounds, how it could be possible to find another IV for forgery attack?
This is an example from my course:
Assume you receive a pair with the plaintext $P_1$ and its MAC ...
- 13
1
vote
0
answers
100
views
Insecure pseudo random functions
Let $F$ be a pseudo-random function. Show that the following constructions are insecure as message authentication codes (in each case $K \in \{0,1\}^n$ is the private key):
$(a)$ To authenticate a ...
- 41
0
votes
1
answer
400
views
Attacks on the RawCBC-MAC if the final step of encrypting with a second key isn't done
This is from Boneh's lecture ECBC-MAC
Here is also a link to the lecture itself - https://www.coursera.org/learn/crypto/lecture/QYT6i/cbc-mac-and-nmac
CBC-MAC with $(K_1, K_2)$ on a message $M$ ...
- 2,167
10
votes
0
answers
193
views
Do CCM and EAX provide key commitment?
In an interesting paper called "Partitioning Oracle Attacks" by Julia Len, Paul Grubbs & Thomas Ristenpart an attack is presented on 1.5 pass AEAD schemes that utilize GMAC (GCM, AES-GCM,...
- 91.2k
1
vote
1
answer
174
views
Is it safe to use the CBC-MAC as a Initial Vector and Key Check Value in deterministic encryption?
I want to deterministically encrypt a short message <50 bytes with AES-128 CBC. I also want to be able to detect if the correct key is being used.
Ciphertext and IV integrity will be guaranteed by ...
- 55
1
vote
0
answers
254
views
CBC-MAC variable-length weakness with MAC size greater than the encryption block size
The title mostly explains it;
CBC-MAC variable-length weakness with MAC size greater than the encryption block size
I've seen that by having the pairs $(M,T_m)$ and $(N,T_n)$, we can generate a ...
- 11
-1
votes
1
answer
94
views
what are the things that aes cbc-mac , aes cmac guarantees?
does aes-cbc-mac guarantees integrity, authenticity and confidentiality?
does aes-cmac guarantees integrity, authenticity and confidentiality?
because I only know that aes-ccm guarantees all i.e. ...
0
votes
1
answer
1k
views
What will be the MAC size of AES CBC-MAC if there are suppose 10 blocks in the AES CBC-MAC?
What will be the mac size of AES CBC-MAC if there are suppose 10 blocks in the AES CBC-MAC?
Will it always be 128 bits MAC size for no matter how many numbers of blocks?
0
votes
2
answers
374
views
Showing a CBC-MAC is not preimage resistant with a proof
So hypothetically I have a an arbitrary block cipher operating in CBC-MAC mode that makes use of a public and static $IV$ as well as a static key $K$.
I want to be able to that this won't be preimage ...
3
votes
1
answer
986
views
CBC encryption + CBC MAC reusing key in MAC-then-Encrypt
I'm reading the Handbook of Applied Cryptography by Alfred J. Menezes et al. Especially, I'm stuck with the case that reusing key for CBC encryption and CBC-MAC in MAC-then-encrypt structure.
My ...
- 305
1
vote
1
answer
372
views
XCBC Authentication
So XCBC was made to counteract lengths attacks against CBC-MAC, but how exactly does the modification made defeat this attack? All I can find are a few papers on why 2-key XCBC isn't actually secure.
- 65
0
votes
0
answers
33
views
CBC-MAC padded message difference [duplicate]
If an attacker had a padded message and its corresponding CBC-MAC tag, how would they construct another message which produces the same tag for the same key as the original? The padding scheme used in ...
- 1
0
votes
0
answers
507
views
Preimage attack on cbc-mac with constant key
Is a hash function created by using CBC-MAC with one public key that does not change secure against preimage attacks? If not, how could you exploit this to find a single block message that hashes to a ...
- 11
1
vote
0
answers
729
views
CBC-MAC Padding weaknesses
I'm trying to wrap my head around how different padding methods affect the strength of CBC-MAC's. Suppose a message is split into different blocks, m1, m2, m3 etc. and the last block is padded with 0'...
- 11
3
votes
0
answers
89
views
What was used for symmetric message authentication before HMAC was invented?
Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else?
I know about NIST FIPS 113 "Data Authentication Algorithm" ...
- 804
0
votes
0
answers
38
views
CBC MAC attack using Arbitrary-length Messages [duplicate]
This is from a lecture :
The adversary sees the message-tag pair(m,τ), where m= (m1,m2,...,mn)The adversary sees the message-tag pair(m′,τ′), where m′= (m′1,m′2,...,m′n)The adversary computes m''=(m1,...
- 1
1
vote
1
answer
163
views
Why CBC-MAC encrypts at each step
Considering CBC-MAC as:
$\qquad H_0 = IV = 0$
$\qquad H_i = E_k(P_i \oplus H_{i-1})$
$\qquad MAC = H_n$
What are the properties that makes this "safer" (less ...
- 129
1
vote
0
answers
564
views
Show that the CBC-MAC construction applied to a PRP is not collision resistant
I'm trying answer the following question. Yes, it is a homework question, so I'm not asking for the answer directly but would like to get some pointers on how to solve it.
So far I have spent several ...
7
votes
2
answers
850
views
Why does the CBC-MAC require PRFs?
I'm stuck on exercise 4.19 from Introduction to Modern Cryptography.
Let $F$ be a keyed function that is a secure (deterministic) MAC for
messages of length $n$. (Note that $F$ need not be a ...
- 706
2
votes
2
answers
1k
views
The attacker model of the Lucky13 attack in TLS
Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page:
The attacks involve detecting small differences in the time at which
TLS error messages ...
- 397
4
votes
1
answer
3k
views
Real time video stream AES encryption with authentication
I am now studying AES encryption for real-time video streaming. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video encryption and authentication. With MAC authentication, ...
- 41
2
votes
0
answers
84
views
Modify basic CBC-MAC construction using a keyed function
Typically, CBC-MAC is a secure MAC for fixed length message if the construction uses a pseudorandom function. However, for a secure MAC, we can use a keyed function that is not necessarily ...
- 53
5
votes
3
answers
6k
views
When do I need to use CBC and HMAC?
As I know CBC does not provide integrity for the message, thus HMAC is used to provide integrity for CBC message. Also, I hear about CBC-MAC which can provide integrity and confidentiality. Which one ...
- 461
1
vote
1
answer
96
views
CCM authenticity bound
Can someone help me understanding the CCM authenticity bound by Phillip Rogaway?
i-e Success probability < $q_{\text{dec}}/2^\tau + \sigma/2^b$.
$\tau$ is tag length, where as $b$ is block length. ...
- 37
0
votes
1
answer
266
views
Cipher based message authentication (CMAC) and block reordering
Is Cipher based message authentication (CMAC) susceptible to block reordering (just like CBC)?
- 123
3
votes
1
answer
224
views
Propagating CBC insecure Authenticated Encryption
why is Propagating CBC (PCBC) insecure for authenticated encryption?
I received the hint that I should feed a message of length $n$ and a message of length $n-1$ to it, but I don't really get what the ...
5
votes
2
answers
3k
views
Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?
In the answer of the following post: Why was AES CBC removed in TLS 1.3?, I quote the following from the chosen answer:
After the Lucky13 attack (a timing oracle caused by MAC-then-encrypt),
it ...
- 397
0
votes
1
answer
270
views
First block as initialization vector in the CBC-MAC
A fixed-length CBC-MAC uses zero block as IV (initialization vector) to prevent from changing the first block.
i.e. tag $t$ = $F(m_x \oplus ... F(m_3 \oplus F(m_2 \oplus F(m_1)))...)$
My question is,...
- 509
5
votes
2
answers
3k
views
Can AES-CBC be safely used in combination with RSA, or must it be CBC-MAC?
The plan is to encrypt files using an AES-256 in CBC mode secret key. The secret key itself will be encrypted with a RSA 2048-bit public key.
Is using AES-CBC sufficiently secure if used in ...
- 53
4
votes
1
answer
2k
views
CBC - Cipher-text stealing decryption
(I asked in stackoverflow and I should ask my question here not there, sorry about that)
The graph shows CBC- with cipher-text stealing and (b) is the block length. The output cipher-text is c1,...,...
- 43
0
votes
1
answer
2k
views
MAC size 128 bits or more?
Just a quick question:
I've seen implemented BouncyCastle's class AeadParameters with MAC length of 128 bits, which was allegedly recommended.
Though when I looked up HMac to implement my own MAC in ...
- 37
2
votes
1
answer
2k
views
Why is ECBC-MAC with one key insecure?
For handling variable-length input and having the calculation of the MAC remain online, encrypting the output of CBC-MAC with a second key is recommended. I have not seen it said that a different key ...
- 3,605
0
votes
1
answer
313
views
CBC-MAC 8 octet ICV compatable with 16 octet block size?
I'm trying to use DTLS in Preshared key mode for CoAP which necessitates using CipherSuite TLS_PSK_WITH_AES_128_CCM_8
I'm trying to start with the CBC-MAC but I'm not sure how to get an 8 octet ICV ...
- 103
0
votes
1
answer
2k
views
CMAC Generation : If input payload length is not aligned in 16 bytes, what are the possible side effects?
While searching for answers ,I understand that RFC AES-CMAC 4493 is suggested by NIST to overcome if payload is not aligned in 16 bytes.
I would like to know what drawbacks/insecure caused by AES-...
- 253
1
vote
1
answer
2k
views
Security of CBC-MAC fixed length with zero padding
I see everywhere that fixed length CBC-MAC should be more or less secure against forgery. But is it really ?
Could you forge a message assuming by example that you use CBC-MAC with let's say always ...
- 121
3
votes
1
answer
140
views
Would a simplified CBC-MAC be safe?
Would using the ciphertext of the previous block as key instead of XOR:ing the block and encrypting with the normal key work?
Normally it's done like this:
What if we instead do this:
Seems like it ...
- 145
0
votes
1
answer
1k
views
CBC-MAC for Arbitrary Length Messages
Katz/Lindell propose the following modification to the basic CBC-MAC scheme to handle variable length messages (p.125):
We sample two uniform independent keys $k_1, k_2\in \{0,1\}^n$. Then to ...
- 468
3
votes
2
answers
3k
views
Having CBC-MAC of a one block message, forge CBC-MAC of two blocks
This whole question pertains to CBC-MAC.
Let's say $a$ is one cipher block long, and the attacker knows the MAC $M(a)$ of $a$, which was generated with a random key. How can the attacker forge the ...
- 31
0
votes
1
answer
133
views
For TLS AES_CCM mode how does CBC_MAC work when the message length is not aligned to block size?
Even after goign through lot of specs I failed to understand how CBC-MAC works, specifically in case we have message not aligned to 16 bytes. Are there any padding bytes?
- 187
1
vote
1
answer
2k
views
CTR and CBC-MAC Demystified
I am trying to understand the background processes within the CCMP. However the concept of CTR and CBC-MAC made me lost.
According to the CCMP Encapsulation block diagram there are inputs like ...
- 11
3
votes
1
answer
309
views
Security proof for CBC as a prefix-free PRF
I am currently trying to fully understand Dan Boneh's/ Victor Shoup's proof in their excellent crypto book draft, that the raw CBC construction is a secure pseudo random function family for prefix-...
- 171