# Tag Info

Accepted

### Why is padding used in CBC mode?

So, I'll answer the theoretical part of your question, since we need a key to address the practical part. Why is padding used in CBC? Blockcipher such as AES are encrypting blocks of a fixed given ...
• 7,266
Accepted

### Why can't we use the first block of AES-CBC as MAC

The MAC value should be calculated over all of the input, not just the first block. The chaining of CBC makes sure that the bits in the last block of ciphertext depends on all the previous blocks.
• 85.8k
Accepted

### What is the correct way to implement PBKDF2 + AES CBC + HMAC?

You'll find there's a lot of splitting hairs regarding this topic, especially key derivation. But yes, your pseudocode is fine, although you may want to revise (0, 128) => (0, 127) and (129, 256) => (...
• 3,695
Accepted

### Insecurity of CBC-MAC

Can anyone explain why CBC-MAC is not secure for variable length message? For the previous question I'll quote Matthew Green's post from 2013: A quick reminder. CBC-MAC is very similar to the ...
• 3,225
Accepted

### MAC using a modified CBC mode of operation

This scheme is not worth the name MAC; it is horribly weak. First and foremost, the tag/MAC is unchanged when two blocks of plaintext are exchanged (because of the commutativity and associativity of ...
• 125k
Accepted

### When do I need to use CBC and HMAC?

Also, there is CBC-MAC for providing integrity and confidentiality. Which one is better CBC-MAC or CBC with HMAC? Generally, asking which one is better results in opinionated answers. However, since ...
• 85.8k
Accepted

### CBC-MAC just to verify integrity

Yes, this is exactly what a message authentication code is for. Its job is to prevent an attacker from tampering with your message, or from forging completely bogus messages. For a secure MAC, it ...
• 44.5k
Accepted

### Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?

When can I consider a ciphersuite an Authenticated Encryption? To cite from Wikipedia: Authenticated Encryption: Authenticated encryption ... is a form of encryption which simultaneously provides ...
• 1,298
Accepted

### Why does the CBC-MAC require PRFs?

The question as posed (in the book) is a bit weird, mainly because it does not state that $F$ is required to be length preserving, however for the CBC-MAC construction to make sense it clearly has to ...
• 6,424

### CBC-MAC based on PRF

The CBC-MAC construction indeed can use a PRF instead of PRP. It is now based on PRP due to historical reasons: the blockciphers used for CBC-MAC were based on permutations. From the security point ...
• 5,547
Accepted

### How can CBC-MAC be secure when message length is fixed?

What you think of is called an extension attack and it turns out that this is the way to go if you would like to break the general CBC-MAC when the message length is not fixed. All that an adversary ...
• 181

### What is the correct way to implement PBKDF2 + AES CBC + HMAC?

IMO, you code looks pretty solid. A few things I might suggest taking a closer look at are: You haven't specified what iteration count you're using for PBKDF2. You should make the iteration count ...
• 44.5k

### Having CBC-MAC of a one block message, forge CBC-MAC of two blocks

Given just $a$ and $M(a)$, you can construct the message $a\,\|\,b$, where $b = a \oplus M(a)$, which gives the same CBC-MAC output $M(a\,\|\,b) = M(a)$ as $a$ itself. Indeed, we can append the block ...
• 44.5k
Accepted

### Why are there no MACs inspired by block cipher modes other than CBC and CFB?

It is certainly wrong to state that "MAC can only be produced with AES in CBC and CFB mode", but there seems to be a simple reason that people were inspired by these modes when thinking up possible ...
• 11.2k

### Real time video stream AES encryption with authentication

updated per comments; Currently Netflix Uses AES-GCM I am now studying the AES encryption for real-time video stream. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video ...
• 43.5k
Accepted

### Security of a simple AEAD construction

Yes, this is secure. (one of the few cases where I'm pretty confident about this). Here are the arguments: Combining a secure (e.g. SUF-CMA) MAC with a secure (e.g. CPA-secure) encryption method in ...
• 44.7k
Accepted

### Is XCBC where k2 and k3 might be the identical, secure?

If key 2 and key 3 has a nonnegligible chance to be the same, then the attacker has a nonnegligible chance of being able to generate a valid (Message, MAC) pair. Here's how it works, if the message ...
• 133k