Questions tagged [cbc-mac]
Cipher Block Chaining MAC (CBC-MAC) is a method of building a message authentication code from a block-cipher.
115 questions
2
votes
0
answers
76
views
Variable length CBC MAC with hash appended
Multiple sources (including this paper from Bellare) claim that there are only 3 ways to make the variable length CBCMAC secure -1) input-length key separation, 2) prepending length 3) encrypt the ...
- 21
5
votes
1
answer
1k
views
CBC encryption + CBC MAC reusing key in MAC-then-Encrypt
I'm reading the Handbook of Applied Cryptography by Alfred J. Menezes et al. Especially, I'm stuck with the case that reusing key for CBC encryption and CBC-MAC in MAC-then-encrypt structure.
My ...
- 145k
2
votes
0
answers
71
views
Producing existential forgery against CBC-MAC
Given the above MAC scheme, I want to ask how to form existential forgery of this scheme?
I have looked through a couple explanations on existential forgery but still struggle understanding the ...
- 21
3
votes
1
answer
370
views
Understanding CBC-MAC Algorithm and Nested Encryption
In the CBC-MAC algorithm as given in the image below, I have two questions:
It is said that the CBC-MAC is simply the last block of ciphertext if the message is encrypted using CBC block cipher mode, ...
- 152
6
votes
3
answers
8k
views
When do I need to use CBC and HMAC?
As I know CBC does not provide integrity for the message, thus HMAC is used to provide integrity for CBC message. Also, I hear about CBC-MAC which can provide integrity and confidentiality. Which one ...
- 94.5k
15
votes
1
answer
12k
views
Difference between CBC-MAC and CMAC
According to Wikipedia, CMAC is based on a variation of CBC-MAC and fixes some security deficiencies in it. However, I could not find a simple and clear explanation of what the differences between ...
- 1
1
vote
1
answer
206
views
Putty PPK Encryption Questions (or AES-CBC)
I am learning about aes-cbc and to simplify things we need two parameters for encryption and randomness (key and IV). IV is random at runtime and will be used to randomize the first cipherblock which ...
- 151k
0
votes
2
answers
292
views
Rate the security of the following MAC
Ok we know when we add a random IV in our "modified encrypted" MAC became useless and the IV can be forgery, then our encryption scheme becomes vulnerable to chosen plaintext attacks.
...
- 1
0
votes
1
answer
2k
views
CBC-MAC Forge Attack Question
I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
CommunityBot
- 1
0
votes
1
answer
422
views
Given the CBC-MAC for a message M and the key K, How could I forge a new message M' so that it has the same CBC-Mac as M
Im looking to learn about forging CBC-Macs.
Given the CBC-Mac for a Message M and the Key used to encrypt the message K.
Can I create a new message M' which would have the same CBC-MAC?
Original ...
- 151k
0
votes
1
answer
2k
views
What is the use of Additional data or associated data in AESGcm. How it is used while encryption and decryption [closed]
I am trying to understand the AESGcm encryption and decryption and there's one field associated data in Encryption and Decryption methods.
https://learn.microsoft.com/en-us/dotnet/api/system.security....
- 151k
1
vote
0
answers
131
views
CBC MAC forgery [duplicate]
$\text{CBC-MAC}$ is defined as follows:
$\text{CBC-MAC}_k() = IV $
$\text{CBC-MAC}_k(m_1, . . . , m_n) = E_k(m_n \oplus \text{CBC-MAC}_k(m_1, . . . , m_{n−1}))$
My lecture notes say that this is ...
- 9,795
1
vote
2
answers
385
views
changing messages for authentication without the tag changed. (CBC-MAC)
do you know about CBC-MAC? I have iv ,MAC and Transaction but no key. and I should change Transaction without change cipher text. do you know how this is possible at all? In addition, I do not have ...
- 151k
7
votes
2
answers
1k
views
Why does the CBC-MAC require PRFs?
I'm stuck on exercise 4.19 from Introduction to Modern Cryptography.
Let $F$ be a keyed function that is a secure (deterministic) MAC for
messages of length $n$. (Note that $F$ need not be a ...
- 49.5k
3
votes
1
answer
451
views
Why a hash function in a manner similar to CBC-MAC is not collision-resistant?
I'm reading the book The Joy of Cryptography by Mike Rosulek.
When reading Chapter 11, on the hash function, I found a very interesting exercise. Does anyone have ideas on how to prove this?
Please ...
- 49.5k
3
votes
1
answer
185
views
Why does CBC-MAC(M) = CFB-MAC(M)?
I don't understand why $\text{CBC-MAC}(M) = \text{CFB-MAC}(M)$. Has it something to do with $\text{CBC-MAC}(M) = C_L$ and $\text{CFB-MAC}(M) = E_K(C'_{L-1})$?
- 94.5k
2
votes
1
answer
185
views
Is the tag generated in MAC equal for equal messages in CBC-MAC?
The Cipher Block Chaining algorithm for generating message authentication codes uses a 0 IV . So my understanding is that same messages will generate same MACs which seems to violate semantic ...
- 94.5k
1
vote
1
answer
500
views
Finding IV for forgery of AES CBC-MAC with non-fixed IV
As CBC mode might do several rounds, how it could be possible to find another IV for forgery attack?
This is an example from my course:
Assume you receive a pair with the plaintext $P_1$ and its MAC ...
- 49.5k
6
votes
1
answer
890
views
OMAC/CMAC constant for different block sizes
OMAC/CMAC only specifies constants for 64-bit (0x1B) and 128-bit (0x87) block size. I would like to know how to get constants ...
- 1
1
vote
0
answers
113
views
Insecure pseudo random functions
Let $F$ be a pseudo-random function. Show that the following constructions are insecure as message authentication codes (in each case $K \in \{0,1\}^n$ is the private key):
$(a)$ To authenticate a ...
- 49.5k
0
votes
1
answer
505
views
Attacks on the RawCBC-MAC if the final step of encrypting with a second key isn't done
This is from Boneh's lecture ECBC-MAC
Here is also a link to the lecture itself - https://www.coursera.org/learn/crypto/lecture/QYT6i/cbc-mac-and-nmac
CBC-MAC with $(K_1, K_2)$ on a message $M$ ...
- 46.4k
1
vote
1
answer
2k
views
Forge CBC-MAC by creating a new message, given the MAC of two messages
The question is quite similar to this one : Forge CBC-MAC given the MAC of two messages and of their concatenation
But I still cannot fully understand it, and here's my question:
given two messages ...
- 3,142
12
votes
0
answers
236
views
Do CCM and EAX provide key commitment?
In an interesting paper called "Partitioning Oracle Attacks" by Julia Len, Paul Grubbs & Thomas Ristenpart an attack is presented on 1.5 pass AEAD schemes that utilize GMAC (GCM, AES-GCM,...
- 94.5k
1
vote
1
answer
210
views
Is it safe to use the CBC-MAC as a Initial Vector and Key Check Value in deterministic encryption?
I want to deterministically encrypt a short message <50 bytes with AES-128 CBC. I also want to be able to detect if the correct key is being used.
Ciphertext and IV integrity will be guaranteed by ...
- 151k
1
vote
0
answers
345
views
CBC-MAC variable-length weakness with MAC size greater than the encryption block size
The title mostly explains it;
CBC-MAC variable-length weakness with MAC size greater than the encryption block size
I've seen that by having the pairs $(M,T_m)$ and $(N,T_n)$, we can generate a ...
- 49.5k
0
votes
2
answers
447
views
Showing a CBC-MAC is not preimage resistant with a proof
So hypothetically I have a an arbitrary block cipher operating in CBC-MAC mode that makes use of a public and static $IV$ as well as a static key $K$.
I want to be able to that this won't be preimage ...
- 145k
-1
votes
1
answer
116
views
what are the things that aes cbc-mac , aes cmac guarantees?
does aes-cbc-mac guarantees integrity, authenticity and confidentiality?
does aes-cmac guarantees integrity, authenticity and confidentiality?
because I only know that aes-ccm guarantees all i.e. ...
0
votes
1
answer
1k
views
What will be the MAC size of AES CBC-MAC if there are suppose 10 blocks in the AES CBC-MAC?
What will be the mac size of AES CBC-MAC if there are suppose 10 blocks in the AES CBC-MAC?
Will it always be 128 bits MAC size for no matter how many numbers of blocks?
- 94.5k
0
votes
1
answer
2k
views
CMAC Generation : If input payload length is not aligned in 16 bytes, what are the possible side effects?
While searching for answers ,I understand that RFC AES-CMAC 4493 is suggested by NIST to overcome if payload is not aligned in 16 bytes.
I would like to know what drawbacks/insecure caused by AES-...
CommunityBot
- 1
1
vote
0
answers
635
views
Show that the CBC-MAC construction applied to a PRP is not collision resistant
I'm trying answer the following question. Yes, it is a homework question, so I'm not asking for the answer directly but would like to get some pointers on how to solve it.
So far I have spent several ...
1
vote
1
answer
490
views
XCBC Authentication
So XCBC was made to counteract lengths attacks against CBC-MAC, but how exactly does the modification made defeat this attack? All I can find are a few papers on why 2-key XCBC isn't actually secure.
- 49.5k
0
votes
0
answers
33
views
CBC-MAC padded message difference [duplicate]
If an attacker had a padded message and its corresponding CBC-MAC tag, how would they construct another message which produces the same tag for the same key as the original? The padding scheme used in ...
- 1
1
vote
0
answers
819
views
CBC-MAC Padding weaknesses
I'm trying to wrap my head around how different padding methods affect the strength of CBC-MAC's. Suppose a message is split into different blocks, m1, m2, m3 etc. and the last block is padded with 0'...
- 376
0
votes
0
answers
571
views
Preimage attack on cbc-mac with constant key
Is a hash function created by using CBC-MAC with one public key that does not change secure against preimage attacks? If not, how could you exploit this to find a single block message that hashes to a ...
- 11
4
votes
1
answer
3k
views
Real time video stream AES encryption with authentication
I am now studying AES encryption for real-time video streaming. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video encryption and authentication. With MAC authentication, ...
CommunityBot
- 1
3
votes
0
answers
96
views
What was used for symmetric message authentication before HMAC was invented?
Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else?
I know about NIST FIPS 113 "Data Authentication Algorithm" ...
- 824
0
votes
0
answers
39
views
CBC MAC attack using Arbitrary-length Messages [duplicate]
This is from a lecture :
The adversary sees the message-tag pair(m,τ), where m= (m1,m2,...,mn)The adversary sees the message-tag pair(m′,τ′), where m′= (m′1,m′2,...,m′n)The adversary computes m''=(m1,...
- 1
1
vote
1
answer
165
views
Why CBC-MAC encrypts at each step
Considering CBC-MAC as:
$\qquad H_0 = IV = 0$
$\qquad H_i = E_k(P_i \oplus H_{i-1})$
$\qquad MAC = H_n$
What are the properties that makes this "safer" (less ...
- 46.4k
2
votes
1
answer
210
views
Why does the authenticated cipher CCM encrypt the MAC too?
Suppose I have Encryption in CTR-Mode and a CBC-MAC. Why should I also encrypt the MAC?
In the documentation of NIST stands: "By encrypting T we avoid CBC-MAC collision attacks".
But I can not ...
- 49.5k
5
votes
1
answer
1k
views
Why does CBC-MAC need prefix-free inputs to be a good PRF?
In the FFX spec, there is a note about using CBC-MAC as the round function.
Security notes. The round function F is constructed in such a way that the set of inputs on
which the CBC-MAC is ...
- 49.5k
2
votes
2
answers
3k
views
CBC-MAC insecure with random IV
Prove that the following modification of $\operatorname{CBC-MAC}$ does not yield a secure fixed-length $\operatorname{MAC}$:
Modify $\operatorname{CBC-MAC}$ so that a random $IV$ is used each time a ...
- 7,082
7
votes
1
answer
3k
views
CBC-MAC , fixed length, all blocks returned
CBC-MAC, with fixed length message.
Is it safe to return all ciphered blocks instead of the last?
My intuition says it is less secure, since is gives an attacker more information.
But how could one ...
- 49.5k
2
votes
2
answers
1k
views
The attacker model of the Lucky13 attack in TLS
Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page:
The attacks involve detecting small differences in the time at which
TLS error messages ...
CommunityBot
- 1
2
votes
1
answer
3k
views
HMAC vs CMAC, which is faster?
I want to know which is faster-HMAC or CMAC.I know CMAC is based on block cipher encryption,where output of each block is X-OR with the next plain text block. If security is not a concern,which will ...
- 94.5k
2
votes
0
answers
88
views
Modify basic CBC-MAC construction using a keyed function
Typically, CBC-MAC is a secure MAC for fixed length message if the construction uses a pseudorandom function. However, for a secure MAC, we can use a keyed function that is not necessarily ...
- 53
1
vote
1
answer
98
views
CCM authenticity bound
Can someone help me understanding the CCM authenticity bound by Phillip Rogaway?
i-e Success probability < $q_{\text{dec}}/2^\tau + \sigma/2^b$.
$\tau$ is tag length, where as $b$ is block length. ...
- 46.4k
0
votes
1
answer
295
views
Cipher based message authentication (CMAC) and block reordering
Is Cipher based message authentication (CMAC) susceptible to block reordering (just like CBC)?
- 151k
3
votes
1
answer
242
views
Propagating CBC insecure Authenticated Encryption
why is Propagating CBC (PCBC) insecure for authenticated encryption?
I received the hint that I should feed a message of length $n$ and a message of length $n-1$ to it, but I don't really get what the ...
- 94.5k
5
votes
2
answers
3k
views
Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?
In the answer of the following post: Why was AES CBC removed in TLS 1.3?, I quote the following from the chosen answer:
After the Lucky13 attack (a timing oracle caused by MAC-then-encrypt),
it ...
- 46.4k
0
votes
1
answer
294
views
First block as initialization vector in the CBC-MAC
A fixed-length CBC-MAC uses zero block as IV (initialization vector) to prevent from changing the first block.
i.e. tag $t$ = $F(m_x \oplus ... F(m_3 \oplus F(m_2 \oplus F(m_1)))...)$
My question is,...
- 151k