Questions tagged [cbc-mac]
Cipher Block Chaining MAC (CBC-MAC) is a method of building a message authentication code from a block-cipher.
115 questions
2
votes
0
answers
76
views
Variable length CBC MAC with hash appended
Multiple sources (including this paper from Bellare) claim that there are only 3 ways to make the variable length CBCMAC secure -1) input-length key separation, 2) prepending length 3) encrypt the ...
- 21
2
votes
0
answers
71
views
Producing existential forgery against CBC-MAC
Given the above MAC scheme, I want to ask how to form existential forgery of this scheme?
I have looked through a couple explanations on existential forgery but still struggle understanding the ...
- 21
3
votes
1
answer
369
views
Understanding CBC-MAC Algorithm and Nested Encryption
In the CBC-MAC algorithm as given in the image below, I have two questions:
It is said that the CBC-MAC is simply the last block of ciphertext if the message is encrypted using CBC block cipher mode, ...
- 85
1
vote
1
answer
206
views
Putty PPK Encryption Questions (or AES-CBC)
I am learning about aes-cbc and to simplify things we need two parameters for encryption and randomness (key and IV). IV is random at runtime and will be used to randomize the first cipherblock which ...
- 123
0
votes
2
answers
292
views
Rate the security of the following MAC
Ok we know when we add a random IV in our "modified encrypted" MAC became useless and the IV can be forgery, then our encryption scheme becomes vulnerable to chosen plaintext attacks.
...
- 3
0
votes
1
answer
422
views
Given the CBC-MAC for a message M and the key K, How could I forge a new message M' so that it has the same CBC-Mac as M
Im looking to learn about forging CBC-Macs.
Given the CBC-Mac for a Message M and the Key used to encrypt the message K.
Can I create a new message M' which would have the same CBC-MAC?
Original ...
0
votes
1
answer
2k
views
CBC-MAC Forge Attack Question
I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
- 161
0
votes
1
answer
2k
views
What is the use of Additional data or associated data in AESGcm. How it is used while encryption and decryption [closed]
I am trying to understand the AESGcm encryption and decryption and there's one field associated data in Encryption and Decryption methods.
https://learn.microsoft.com/en-us/dotnet/api/system.security....
1
vote
0
answers
131
views
CBC MAC forgery [duplicate]
$\text{CBC-MAC}$ is defined as follows:
$\text{CBC-MAC}_k() = IV $
$\text{CBC-MAC}_k(m_1, . . . , m_n) = E_k(m_n \oplus \text{CBC-MAC}_k(m_1, . . . , m_{n−1}))$
My lecture notes say that this is ...
- 151
1
vote
2
answers
385
views
changing messages for authentication without the tag changed. (CBC-MAC)
do you know about CBC-MAC? I have iv ,MAC and Transaction but no key. and I should change Transaction without change cipher text. do you know how this is possible at all? In addition, I do not have ...
- 21
3
votes
1
answer
451
views
Why a hash function in a manner similar to CBC-MAC is not collision-resistant?
I'm reading the book The Joy of Cryptography by Mike Rosulek.
When reading Chapter 11, on the hash function, I found a very interesting exercise. Does anyone have ideas on how to prove this?
Please ...
user99141
3
votes
1
answer
185
views
Why does CBC-MAC(M) = CFB-MAC(M)?
I don't understand why $\text{CBC-MAC}(M) = \text{CFB-MAC}(M)$. Has it something to do with $\text{CBC-MAC}(M) = C_L$ and $\text{CFB-MAC}(M) = E_K(C'_{L-1})$?
- 31
2
votes
1
answer
185
views
Is the tag generated in MAC equal for equal messages in CBC-MAC?
The Cipher Block Chaining algorithm for generating message authentication codes uses a 0 IV . So my understanding is that same messages will generate same MACs which seems to violate semantic ...
- 69
1
vote
1
answer
500
views
Finding IV for forgery of AES CBC-MAC with non-fixed IV
As CBC mode might do several rounds, how it could be possible to find another IV for forgery attack?
This is an example from my course:
Assume you receive a pair with the plaintext $P_1$ and its MAC ...
- 13
1
vote
0
answers
113
views
Insecure pseudo random functions
Let $F$ be a pseudo-random function. Show that the following constructions are insecure as message authentication codes (in each case $K \in \{0,1\}^n$ is the private key):
$(a)$ To authenticate a ...
- 41
0
votes
1
answer
505
views
Attacks on the RawCBC-MAC if the final step of encrypting with a second key isn't done
This is from Boneh's lecture ECBC-MAC
Here is also a link to the lecture itself - https://www.coursera.org/learn/crypto/lecture/QYT6i/cbc-mac-and-nmac
CBC-MAC with $(K_1, K_2)$ on a message $M$ ...
- 2,316
12
votes
0
answers
236
views
Do CCM and EAX provide key commitment?
In an interesting paper called "Partitioning Oracle Attacks" by Julia Len, Paul Grubbs & Thomas Ristenpart an attack is presented on 1.5 pass AEAD schemes that utilize GMAC (GCM, AES-GCM,...
- 94.5k
1
vote
1
answer
210
views
Is it safe to use the CBC-MAC as a Initial Vector and Key Check Value in deterministic encryption?
I want to deterministically encrypt a short message <50 bytes with AES-128 CBC. I also want to be able to detect if the correct key is being used.
Ciphertext and IV integrity will be guaranteed by ...
- 55
1
vote
0
answers
345
views
CBC-MAC variable-length weakness with MAC size greater than the encryption block size
The title mostly explains it;
CBC-MAC variable-length weakness with MAC size greater than the encryption block size
I've seen that by having the pairs $(M,T_m)$ and $(N,T_n)$, we can generate a ...
- 11
-1
votes
1
answer
116
views
what are the things that aes cbc-mac , aes cmac guarantees?
does aes-cbc-mac guarantees integrity, authenticity and confidentiality?
does aes-cmac guarantees integrity, authenticity and confidentiality?
because I only know that aes-ccm guarantees all i.e. ...
0
votes
1
answer
1k
views
What will be the MAC size of AES CBC-MAC if there are suppose 10 blocks in the AES CBC-MAC?
What will be the mac size of AES CBC-MAC if there are suppose 10 blocks in the AES CBC-MAC?
Will it always be 128 bits MAC size for no matter how many numbers of blocks?
0
votes
2
answers
447
views
Showing a CBC-MAC is not preimage resistant with a proof
So hypothetically I have a an arbitrary block cipher operating in CBC-MAC mode that makes use of a public and static $IV$ as well as a static key $K$.
I want to be able to that this won't be preimage ...
5
votes
1
answer
1k
views
CBC encryption + CBC MAC reusing key in MAC-then-Encrypt
I'm reading the Handbook of Applied Cryptography by Alfred J. Menezes et al. Especially, I'm stuck with the case that reusing key for CBC encryption and CBC-MAC in MAC-then-encrypt structure.
My ...
- 335
1
vote
1
answer
490
views
XCBC Authentication
So XCBC was made to counteract lengths attacks against CBC-MAC, but how exactly does the modification made defeat this attack? All I can find are a few papers on why 2-key XCBC isn't actually secure.
- 65
0
votes
0
answers
33
views
CBC-MAC padded message difference [duplicate]
If an attacker had a padded message and its corresponding CBC-MAC tag, how would they construct another message which produces the same tag for the same key as the original? The padding scheme used in ...
- 1
0
votes
0
answers
571
views
Preimage attack on cbc-mac with constant key
Is a hash function created by using CBC-MAC with one public key that does not change secure against preimage attacks? If not, how could you exploit this to find a single block message that hashes to a ...
- 11
1
vote
0
answers
819
views
CBC-MAC Padding weaknesses
I'm trying to wrap my head around how different padding methods affect the strength of CBC-MAC's. Suppose a message is split into different blocks, m1, m2, m3 etc. and the last block is padded with 0'...
- 11
3
votes
0
answers
96
views
What was used for symmetric message authentication before HMAC was invented?
Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else?
I know about NIST FIPS 113 "Data Authentication Algorithm" ...
- 824
0
votes
0
answers
39
views
CBC MAC attack using Arbitrary-length Messages [duplicate]
This is from a lecture :
The adversary sees the message-tag pair(m,τ), where m= (m1,m2,...,mn)The adversary sees the message-tag pair(m′,τ′), where m′= (m′1,m′2,...,m′n)The adversary computes m''=(m1,...
- 1
1
vote
1
answer
165
views
Why CBC-MAC encrypts at each step
Considering CBC-MAC as:
$\qquad H_0 = IV = 0$
$\qquad H_i = E_k(P_i \oplus H_{i-1})$
$\qquad MAC = H_n$
What are the properties that makes this "safer" (less ...
- 129
1
vote
0
answers
635
views
Show that the CBC-MAC construction applied to a PRP is not collision resistant
I'm trying answer the following question. Yes, it is a homework question, so I'm not asking for the answer directly but would like to get some pointers on how to solve it.
So far I have spent several ...
7
votes
2
answers
1k
views
Why does the CBC-MAC require PRFs?
I'm stuck on exercise 4.19 from Introduction to Modern Cryptography.
Let $F$ be a keyed function that is a secure (deterministic) MAC for
messages of length $n$. (Note that $F$ need not be a ...
- 706
2
votes
2
answers
1k
views
The attacker model of the Lucky13 attack in TLS
Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page:
The attacks involve detecting small differences in the time at which
TLS error messages ...
- 427
4
votes
1
answer
3k
views
Real time video stream AES encryption with authentication
I am now studying AES encryption for real-time video streaming. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video encryption and authentication. With MAC authentication, ...
- 41
2
votes
0
answers
88
views
Modify basic CBC-MAC construction using a keyed function
Typically, CBC-MAC is a secure MAC for fixed length message if the construction uses a pseudorandom function. However, for a secure MAC, we can use a keyed function that is not necessarily ...
- 53
6
votes
3
answers
8k
views
When do I need to use CBC and HMAC?
As I know CBC does not provide integrity for the message, thus HMAC is used to provide integrity for CBC message. Also, I hear about CBC-MAC which can provide integrity and confidentiality. Which one ...
- 473
1
vote
1
answer
98
views
CCM authenticity bound
Can someone help me understanding the CCM authenticity bound by Phillip Rogaway?
i-e Success probability < $q_{\text{dec}}/2^\tau + \sigma/2^b$.
$\tau$ is tag length, where as $b$ is block length. ...
- 37
0
votes
1
answer
295
views
Cipher based message authentication (CMAC) and block reordering
Is Cipher based message authentication (CMAC) susceptible to block reordering (just like CBC)?
- 123
3
votes
1
answer
242
views
Propagating CBC insecure Authenticated Encryption
why is Propagating CBC (PCBC) insecure for authenticated encryption?
I received the hint that I should feed a message of length $n$ and a message of length $n-1$ to it, but I don't really get what the ...
5
votes
2
answers
3k
views
Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?
In the answer of the following post: Why was AES CBC removed in TLS 1.3?, I quote the following from the chosen answer:
After the Lucky13 attack (a timing oracle caused by MAC-then-encrypt),
it ...
- 427
0
votes
1
answer
294
views
First block as initialization vector in the CBC-MAC
A fixed-length CBC-MAC uses zero block as IV (initialization vector) to prevent from changing the first block.
i.e. tag $t$ = $F(m_x \oplus ... F(m_3 \oplus F(m_2 \oplus F(m_1)))...)$
My question is,...
- 509
5
votes
2
answers
3k
views
Can AES-CBC be safely used in combination with RSA, or must it be CBC-MAC?
The plan is to encrypt files using an AES-256 in CBC mode secret key. The secret key itself will be encrypted with a RSA 2048-bit public key.
Is using AES-CBC sufficiently secure if used in ...
- 53
4
votes
1
answer
2k
views
CBC - Cipher-text stealing decryption
(I asked in stackoverflow and I should ask my question here not there, sorry about that)
The graph shows CBC- with cipher-text stealing and (b) is the block length. The output cipher-text is c1,...,...
- 43
0
votes
1
answer
3k
views
MAC size 128 bits or more?
Just a quick question:
I've seen implemented BouncyCastle's class AeadParameters with MAC length of 128 bits, which was allegedly recommended.
Though when I looked up HMac to implement my own MAC in ...
- 37
2
votes
1
answer
2k
views
Why is ECBC-MAC with one key insecure?
For handling variable-length input and having the calculation of the MAC remain online, encrypting the output of CBC-MAC with a second key is recommended. I have not seen it said that a different key ...
- 3,705
0
votes
1
answer
349
views
CBC-MAC 8 octet ICV compatable with 16 octet block size?
I'm trying to use DTLS in Preshared key mode for CoAP which necessitates using CipherSuite TLS_PSK_WITH_AES_128_CCM_8
I'm trying to start with the CBC-MAC but I'm not sure how to get an 8 octet ICV ...
- 103
0
votes
1
answer
2k
views
CMAC Generation : If input payload length is not aligned in 16 bytes, what are the possible side effects?
While searching for answers ,I understand that RFC AES-CMAC 4493 is suggested by NIST to overcome if payload is not aligned in 16 bytes.
I would like to know what drawbacks/insecure caused by AES-...
- 253
1
vote
1
answer
2k
views
Security of CBC-MAC fixed length with zero padding
I see everywhere that fixed length CBC-MAC should be more or less secure against forgery. But is it really ?
Could you forge a message assuming by example that you use CBC-MAC with let's say always ...
- 121
3
votes
1
answer
155
views
Would a simplified CBC-MAC be safe?
Would using the ciphertext of the previous block as key instead of XOR:ing the block and encrypting with the normal key work?
Normally it's done like this:
What if we instead do this:
Seems like it ...
- 145
0
votes
1
answer
1k
views
CBC-MAC for Arbitrary Length Messages
Katz/Lindell propose the following modification to the basic CBC-MAC scheme to handle variable length messages (p.125):
We sample two uniform independent keys $k_1, k_2\in \{0,1\}^n$. Then to ...
- 468