Search Results

If key 2 and key 3 has a nonnegligible chance to be the same, then the attacker has a nonnegligible chance of being able to generate a valid (Message, MAC) pair. Here's how it works, if the message i …

My question is, if the first block is used as IV, then is it secure (unforgeable), and why? Suppose with this scheme, you have the MAC for the message $[m_1, m_2, m_3]$. Could someone without th …

Can I create a new message M' which would have the same CBC-MAC? Sure can. On the other hand, you're learning, and I believe you learn better by figuring out it yourself, and so I'll just give a hin …

Well, yes, it does matter; however the terminology 'CBC-MAC' does not specify which. CBC-MAC is a generic construction that takes an arbitrary block cipher, and turns it into an object that acts like …

That doesn't look likely. Given $\text{CBC-MAC}(d||e) = y$, we know that, saying at the initial IV state of $0$, then processing the blocks $d$ and $e$ gives us $y$; that doesn't say where we end up …

No, CMAC is not susceptible to block reordering. Unlike CBC, the attacker does not see the values of the intermediate encryptions (and because of the tweak applied to the last block, he can't find th …

Actually, even if the IV is fixed (say, to the all-zero value), then it is still possible to find a second message that has the same CBC-MAC, even if you don't know the key. Suppose you have a message …

Can anybody explain these different fields in both the algorithms and their usage. Both these fields are designed to detect it if someone in the middle tries to play games with the encrypted data. …

An attacker can trivial forge the MAC of any message, given one valid MAC of a known message, in either CBC mode or CTR mode. Let us assume that the attacker knows a message $m$ and its MAC $E(k, H(m …

That is, why is the scheme insecure if we compute the output tag $t'$ using $F_{k_1}$? Computing $F_{k_1}( \text{CBCMAC}_{k_1}(M))$ is precisely equivalent to taking the padded message $M$, appen …

Actually, PuTTY derives both the AES key and the IV (and the HMAC key) from the passphrase; because the decryptor also knows the passphrase, he can recover the IV along with the AES/HMAC keys. This is …

Am I thinking correctly and will an malicious user (which has access to encryption keys) not (or very hard) be able to generate a collision in my IV-ciphertext combination so that the server is group …

From the sound of your questions, it almost appears that you have some confusion between the CBC-MAC key and the CBC-MAC tag. The CBC-MAC algorithm takes the message (in this case, most likely the ci …

Can a passive adversary perform Lucky13? No. The attacker must have the capability to inject chosen ciphertexts into the stream. A passive adversary (who listens into the encrypted traffic but …