# Tag Info

## Hot answers tagged cbc-mac

16

Well, let's try it, and see how hard it is to forge a message. Let's say for illustrative purposes that each character is a block, and that numbers represent the length indicator section. And let's start by putting the length indicator at the end. So, XXXXXXX7 represents a 7-block message, with the '7' indicator at the end. Let's also say that, $_{MAC}... 15 So, I'll answer the theoretical part of your question, since we need a key to address the practical part. Why is padding used in CBC? Blockcipher such as AES are encrypting blocks of a fixed given size only, we call it the "blocksize". So, what if your data is smaller than the blocksize ? An easy solution is to add what we call "padding" to your plaintext ... 14 The problem with CBC-MAC for variable-length messages is that CBC-MAC applied to a one-block message essentially amounts to an oracle for evaluating the block cipher at values of the adversary's choice. And that oracle allows an adversary to break the scheme. Consider first CMAC restricted to messages that consist of a whole number of blocks. Then the ... 13 I'll assume All ciphered blocks means the same as ciphertext for CBC-Encryption with implicit zero IV, while CBC-MAC is the last block of that. All ciphered blocks is unsafe as a message authenticator for messages longer than one block, for it succumbs to a trivial attack (here with two blocks): Eve intercepts message$M=M_0||M_1$and its authenticator$A=...

12

The MAC value should be calculated over all of the input, not just the first block. The chaining of CBC makes sure that the bits in the last block of ciphertext depends on all the previous blocks.

11

You'll find there's a lot of splitting hairs regarding this topic, especially key derivation. But yes, your pseudocode is fine, although you may want to revise (0, 128) => (0, 127) and (129, 256) => (128, 255) ... (correct me if I'm wrong?). Also, you might want to implement a constant-time comparison function for verifying the mac. Have I derived the ...

10

Can anyone explain why CBC-MAC is not secure for variable length message? For the previous question I'll quote Matthew Green's post from 2013: A quick reminder. CBC-MAC is very similar to the classic CBC mode for encryption, with a few major differences. First, the Initialization Vector (IV) is a fixed value, usually zero. Second, CBC-MAC only ...

9

This scheme is not worth the name MAC; it is horribly weak. First and foremost, the tag/MAC is unchanged when two blocks of plaintext are exchanged (because of the commutativity and associativity of the $\oplus$ operation). If follows that from any message with at least two different blocks, we can make a different message for which we know the tag/MAC. ...

8

Yes, this is exactly what a message authentication code is for. Its job is to prevent an attacker from tampering with your message, or from forging completely bogus messages. For a secure MAC, it should not matter what these messages contain. (And no, a secure MAC cannot compromise your key; if it did, it would by definition not be secure, since an ...

8

When can I consider a ciphersuite an Authenticated Encryption? To cite from Wikipedia: Authenticated Encryption: Authenticated encryption ... is a form of encryption which simultaneously provides confidentiality, integrity, and authenticity assurances on the data. Note the focus on simultaneously. Is AES-CBC in TLS 1.2 an Authenticated Encryption (...

7

The CBC-MAC construction indeed can use a PRF instead of PRP. It is now based on PRP due to historical reasons: the blockciphers used for CBC-MAC were based on permutations. From the security point of view there will be no difference: the security proof for the CBC-MAC first converts PRP to PRF (which is indistinguishable up to $2^{n/2}$ queries) and then ...

7

Well, yes, it does matter; however the terminology 'CBC-MAC' does not specify which. CBC-MAC is a generic construction that takes an arbitrary block cipher, and turns it into an object that acts like a MAC for fixed length messages (much like CBC mode is a generic construction that takes an arbitrary block cipher, and turns it into a object that encrypts ...

7

IMO, you code looks pretty solid. A few things I might suggest taking a closer look at are: You haven't specified what iteration count you're using for PBKDF2. You should make the iteration count as high as practical. PKCS #5 suggests a minimum of 1000 iterations, but that recommendation comes from nearly two decades ago. IMO, nowadays there's very ...

7

Also, there is CBC-MAC for providing integrity and confidentiality. Which one is better CBC-MAC or CBC with HMAC? Generally, asking which one is better results in opinionated answers. However, since CBC-MAC cannot be used for dynamically sized messages and may lead to compromise when the same key is used, HMAC definitely is less prone to abuse. Differently ...

6

Because CBC-MAC with inputs that are not prefix free is weak against existential forgery, meaning it is not a "secure" MAC. More precisely, CBC-MAC is easily distinguishable from a random function (i.e. not a PRF) when the input domain is not prefix-free. This is because an adversary can request the CBC-MAC of messages $M_0$ and $M_1$, and then xor the MAC ...

6

It is certainly wrong to state that "MAC can only be produced with AES in CBC and CFB mode", but there seems to be a simple reason that people were inspired by these modes when thinking up possible MAC constructions: They carry along some state that incorporates information from the message while traversing the input blocks. In both modes, encrypting a block ...

6

updated per comments; Currently Netflix Uses AES-GCM I am now studying the AES encryption for real-time video stream. It seems that Netflix uses the AES-GCM (or CBC + MAC) mode for real-time video encryption and authentication. With MAC authentication, client can only get the MAC message after the> whole video is encrypted and authenticated. After that, ...

5

What you think of is called an extension attack and it turns out that this is the way to go if you would like to break the general CBC-MAC when the message length is not fixed. All that an adversary needs to do is to mount a chosen message attack. Suppose he asks for the tag on the message $m=m_1||m_2||...||m_l$. The resulting CBC MAC would be $MAC_k(m)=t$....

5

If key 2 and key 3 has a nonnegligible chance to be the same, then the attacker has a nonnegligible chance of being able to generate a valid (Message, MAC) pair. Here's how it works, if the message is not a multiple of 16, then XCBC pads the message out to the next multiple of 16; if it already is, the message remains the same. Then, XCBC logically does a ...

5

Why over-complicate it like that, D1 and D2 generates random 64-bit P (half the block size of AES) they send it to each other both generate AES(key,P_own||P_other) and again send to each other (note that these are different for each) then both can verify that what they received is equal to AES(key,P_other||P_own) Upside here is that it is a fully ...

5

1) The adversary queries the oracle (with some randomly chosen message $m$) and gets as a result a message $m=m_1|m_2|...$ and its tag $t=(t_0,F_{k_2}(t_r))$. She then draws $\rho$ uniformly at random in $\{0,1\}^n$ and outputs the message $m=\rho\oplus m_1|m_2|...$ and its (valid) tag $t=(\rho\oplus t_0,F_{k_2}(t_r))$. 2) The adversary queries the oracle (...

5

The quoted sentences means: if there is a collision among the MACs of the $2^{(n+1)/2}$ messages submitted, the attacker playing the distinguishing game announces that the oracle is a random function; else announces that the oracle is CBC-MAC. This works because the messages submitted differ only in their first block, thus will never collide under CBC-MAC, ...

5

Yes. Assume that the attacker knows the ciphertext $c = c_1 \mathbin\| c_2$, the initialization vector $v$ and the plaintext $m = m_1 \mathbin\| m_2$. This tells them that $D_k(c_1) = m_1 \oplus v$ and $D_k(c_2) = m_2 \oplus c_1$, where $D_k(\cdot)$ denotes block cipher decryption under the (unknown) key $k$. In particular, this implies that, if the ...

5

Yes, this is secure. (one of the few cases where I'm pretty confident about this). Here are the arguments: Combining a secure (e.g. SUF-CMA) MAC with a secure (e.g. CPA-secure) encryption method in encrypt-then-authenticate is generally proven secure. This was shown in "Authenticated Encryption: Relations among notions and analysis of the generic ...

5

An attacker can trivial forge the MAC of any message, given one valid MAC of a known message, in either CBC mode or CTR mode. Let us assume that the attacker knows a message $m$ and its MAC $E(k, H(m)) = IV, E(k, IV, H(m))$; he has a message $m'$ he wants to form the message to. He computes $\delta = H(m) \oplus H(m')$, then: For CTR mode, he computes $IV,... 5 It sounds like you have one big misconception in your question: Also, I hear about CBC-MAC which can provide integrity and confidentiality. Which one is better CBC-MAC or CBC with HMAC? The first sentence reads like you misunderstand CBC-MAC to be an algorithm that provides two properties, integrity and confidentiality. But in reality, CBC-MAC can only ... 5 The question as posed (in the book) is a bit weird, mainly because it does not state that$F$is required to be length preserving, however for the CBC-MAC construction to make sense it clearly has to be. But ignoring this fact for a moment, one of your observations was indeed crucial. A MAC does in general not hide it's input message. As you point out, if$F'...

4

Yes, your understanding is correct. With the CBC-MAC's of $(a), (b)$ and $(a||b)$ you can forge the following new messages: \$(a||b \oplus MAC(a)), \\ (b||a \oplus MAC(b)), \\ (b||b \oplus MAC(b)),\\ (a||a \oplus MAC(a)),\\ (a||b||a \oplus MAC(a||b)), \\ (a||b||b \oplus MAC(a||b)), \\ (a||b \oplus MAC(a)||a \oplus MAC(b))\\ (a||b \oplus MAC(a)||b \oplus MAC(...

4

An answer surfaced from careful reading of appropriate documentation. The MAC in the question is also defined in ANSI X9.19, and is supported by some PKCS#11 tokens as the mechanism CKM_DES3_X919_MAC_GENERAL. Other than that, this MAC can be simulated using CKM_DES_MAC_GENERAL (or CKM_DES_CBC or CKM_DES3_CBC) for all but the last block, then CKM_DES3_CBC; ...

Only top voted, non community-wiki answers of a minimum length are eligible