Hot answers tagged

18 votes
Accepted

Why is padding used in CBC mode?

So, I'll answer the theoretical part of your question, since we need a key to address the practical part. Why is padding used in CBC? Blockcipher such as AES are encrypting blocks of a fixed given ...
user avatar
  • 7,266
12 votes
Accepted

Why can't we use the first block of AES-CBC as MAC

The MAC value should be calculated over all of the input, not just the first block. The chaining of CBC makes sure that the bits in the last block of ciphertext depends on all the previous blocks.
user avatar
  • 85.8k
12 votes
Accepted

What is the correct way to implement PBKDF2 + AES CBC + HMAC?

You'll find there's a lot of splitting hairs regarding this topic, especially key derivation. But yes, your pseudocode is fine, although you may want to revise (0, 128) => (0, 127) and (129, 256) => (...
user avatar
  • 3,695
11 votes
Accepted

Insecurity of CBC-MAC

Can anyone explain why CBC-MAC is not secure for variable length message? For the previous question I'll quote Matthew Green's post from 2013: A quick reminder. CBC-MAC is very similar to the ...
user avatar
  • 3,225
9 votes
Accepted

MAC using a modified CBC mode of operation

This scheme is not worth the name MAC; it is horribly weak. First and foremost, the tag/MAC is unchanged when two blocks of plaintext are exchanged (because of the commutativity and associativity of ...
user avatar
  • 125k
9 votes
Accepted

When do I need to use CBC and HMAC?

Also, there is CBC-MAC for providing integrity and confidentiality. Which one is better CBC-MAC or CBC with HMAC? Generally, asking which one is better results in opinionated answers. However, since ...
user avatar
  • 85.8k
8 votes
Accepted

CBC-MAC just to verify integrity

Yes, this is exactly what a message authentication code is for. Its job is to prevent an attacker from tampering with your message, or from forging completely bogus messages. For a secure MAC, it ...
user avatar
8 votes
Accepted

Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?

When can I consider a ciphersuite an Authenticated Encryption? To cite from Wikipedia: Authenticated Encryption: Authenticated encryption ... is a form of encryption which simultaneously provides ...
user avatar
8 votes
Accepted

Why does the CBC-MAC require PRFs?

The question as posed (in the book) is a bit weird, mainly because it does not state that $F$ is required to be length preserving, however for the CBC-MAC construction to make sense it clearly has to ...
user avatar
  • 6,424
7 votes

CBC-MAC based on PRF

The CBC-MAC construction indeed can use a PRF instead of PRP. It is now based on PRP due to historical reasons: the blockciphers used for CBC-MAC were based on permutations. From the security point ...
user avatar
7 votes
Accepted

How can CBC-MAC be secure when message length is fixed?

What you think of is called an extension attack and it turns out that this is the way to go if you would like to break the general CBC-MAC when the message length is not fixed. All that an adversary ...
user avatar
  • 181
7 votes

What is the correct way to implement PBKDF2 + AES CBC + HMAC?

IMO, you code looks pretty solid. A few things I might suggest taking a closer look at are: You haven't specified what iteration count you're using for PBKDF2. You should make the iteration count ...
user avatar
7 votes

Having CBC-MAC of a one block message, forge CBC-MAC of two blocks

Given just $a$ and $M(a)$, you can construct the message $a\,\|\,b$, where $b = a \oplus M(a)$, which gives the same CBC-MAC output $M(a\,\|\,b) = M(a)$ as $a$ itself. Indeed, we can append the block ...
user avatar
6 votes
Accepted

Why are there no MACs inspired by block cipher modes other than CBC and CFB?

It is certainly wrong to state that "MAC can only be produced with AES in CBC and CFB mode", but there seems to be a simple reason that people were inspired by these modes when thinking up possible ...
user avatar
  • 11.2k
6 votes

Real time video stream AES encryption with authentication

updated per comments; Currently Netflix Uses AES-GCM I am now studying the AES encryption for real-time video stream. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video ...
user avatar
  • 43.5k
5 votes
Accepted

Security of a simple AEAD construction

Yes, this is secure. (one of the few cases where I'm pretty confident about this). Here are the arguments: Combining a secure (e.g. SUF-CMA) MAC with a secure (e.g. CPA-secure) encryption method in ...
user avatar
  • 44.7k
5 votes
Accepted

Is XCBC where k2 and k3 might be the identical, secure?

If key 2 and key 3 has a nonnegligible chance to be the same, then the attacker has a nonnegligible chance of being able to generate a valid (Message, MAC) pair. Here's how it works, if the message ...
user avatar
  • 133k
5 votes
Accepted

encryption of digest of unkeyed hash function is susceptible to forgery?

An attacker can trivial forge the MAC of any message, given one valid MAC of a known message, in either CBC mode or CTR mode. Let us assume that the attacker knows a message $m$ and its MAC $E(k, H(m)...
user avatar
  • 133k
5 votes

When do I need to use CBC and HMAC?

It sounds like you have one big misconception in your question: Also, I hear about CBC-MAC which can provide integrity and confidentiality. Which one is better CBC-MAC or CBC with HMAC? The first ...
user avatar
4 votes
Accepted

CBC-MAC key can be added to ciphertext?

From the sound of your questions, it almost appears that you have some confusion between the CBC-MAC key and the CBC-MAC tag. The CBC-MAC algorithm takes the message (in this case, most likely the ...
user avatar
  • 133k
4 votes
Accepted

What are options to compute DES retail MAC (aka ISO 9797-1 mode 3) under PKCS#11?

An answer surfaced from careful reading of appropriate documentation. The MAC in the question is also defined in ANSI X9.19, and is supported by some PKCS#11 tokens as the mechanism ...
user avatar
  • 125k
4 votes

CBC with a fixed or random IV

For question (1): This page gives some hints on IVs and CBC: https://defuse.ca/cbcmodeiv.htm I copy-paste the part about IVs "predictability" Chosen-Plaintext Attacks Randomness is not ...
user avatar
  • 3,225
4 votes

HMAC vs CMAC, which is faster?

Which MAC algorithm is faster - CBC based MAC's or HMAC - depends completely on which ciphers and hashes are used. Furthermore, it depends on the runtime environment that contains the hash and cipher ...
user avatar
  • 85.8k
4 votes
Accepted

Can a block cipher be used to encrypt wireless communications?

Yes, you can encrypt wireless communication using a block cipher in a specific mode of operation to provide confidentiality. Transport modes also require integrity and authentication to protect ...
user avatar
  • 85.8k
4 votes

How does encrypt-then-MAC protect from CCA?

What CCA basically means is that attacker supplies for decryption any ciphertext he/she wants and observes the reaction of the system. This reaction can be used to infer information about plaintext/...
user avatar
4 votes

Use of Same Key for CTR and CBC-MAC in CCM Mode of Operation?

Basically you should never reuse a key and neither should you use CBC-MAC. CCM is considered secure because the designer knew about the issues of reusing a key and CBC-MAC length extension issues. The ...
user avatar
  • 85.8k
4 votes
Accepted

CBC - Cipher-text stealing decryption

Let's say we have a ciphertext of length $(N-1)B < n < NB$, for $B$ the blocksize at hand (typically 128 for AES), where the ciphertext is made with $C_1, C_2, C_3, C_4$, with $C_3$ being ...
user avatar
  • 7,266
4 votes
Accepted

Can AES-CBC be safely used in combination with RSA, or must it be CBC-MAC?

It depends on the system if RSA + CBC mode is secure. It could be but better options are available. CBC mode, if correctly applied, can certainly provide confidentiality of the message. In that case ...
user avatar
  • 85.8k
4 votes

Cipher based message authentication (CMAC) and block reordering

No, CMAC is not susceptible to block reordering. Unlike CBC, the attacker does not see the values of the intermediate encryptions (and because of the tweak applied to the last block, he can't find ...
user avatar
  • 133k
4 votes
Accepted

Why CBC-MAC encrypts at each step

What are the properties that makes this "safer" (less exposed to failure) than just: [simple construction] Well, there's an easy attack on the simple construction: Pick any message block $P$ and ...
user avatar
  • 44.7k

Only top scored, non community-wiki answers of a minimum length are eligible