All Topics  
CBC-MAC

 

 
   Email Print
   Bookmark   Link
 

 

CBC-MAC
 
 
  Topics CBC-MAC Topic Home

In cryptography
Cryptography

Cryptography is the practice and study of hiding information. In modern times cryptography is considered a branch of both mathematics and computer science and is affiliated closely with information theory, computer security and engineering....
, a Cipher Block Chaining Message Authentication Code, abbreviated CBC-MAC, is a technique for constructing a message authentication code
Message authentication code

A cryptography message authentication code is a short piece of information used to authenticate a message.A MAC algorithm accepts as input a secret key and an arbitrary-length message to be authenticated, and outputs a MAC ....
 from a block cipher
Block cipher

In cryptography, a block cipher is a symmetric key algorithm cipher which operates on fixed-length groups of bits, termed blocks, with an unvarying transformation....
. The message is encrypted with some block cipher algorithm in CBC mode
Block cipher modes of operation

In cryptography, a block cipher operates on blocks of fixed length, often 64 or 128 bits. Because messages may be of any length, and because encrypting the same plaintext under the same key always produces the same output , several modes of operation have been invented which allow block ciphers to provide confidentiality for messages of arbit...
 to create a chain of blocks such that each block depends on the proper encryption of the block before it. This interdependence ensures that a change to any of the plaintext bits will cause the final encrypted block to change in a way that cannot be predicted or counteracted without knowing the key to the block cipher.

To calculate the CBC-MAC of message one encrypts in CBC mode with zero initialization vector
Initialization vector

In cryptography, an initialization vector is a block of bits that is required to allow a stream cipher or a block cipher to be executed in any of several block cipher modes of operation to produce a unique stream independent from other streams produced by the same encryption key, without having to go through a re-keying process....
.






Discussion
Ask a question about 'CBC-MAC'
Start a new discussion about 'CBC-MAC'
Answer questions from other users
Full Discussion Forum



Encyclopedia


In cryptography
Cryptography

Cryptography is the practice and study of hiding information. In modern times cryptography is considered a branch of both mathematics and computer science and is affiliated closely with information theory, computer security and engineering....
, a Cipher Block Chaining Message Authentication Code, abbreviated CBC-MAC, is a technique for constructing a message authentication code
Message authentication code

A cryptography message authentication code is a short piece of information used to authenticate a message.A MAC algorithm accepts as input a secret key and an arbitrary-length message to be authenticated, and outputs a MAC ....
 from a block cipher
Block cipher

In cryptography, a block cipher is a symmetric key algorithm cipher which operates on fixed-length groups of bits, termed blocks, with an unvarying transformation....
. The message is encrypted with some block cipher algorithm in CBC mode
Block cipher modes of operation

In cryptography, a block cipher operates on blocks of fixed length, often 64 or 128 bits. Because messages may be of any length, and because encrypting the same plaintext under the same key always produces the same output , several modes of operation have been invented which allow block ciphers to provide confidentiality for messages of arbit...
 to create a chain of blocks such that each block depends on the proper encryption of the block before it. This interdependence ensures that a change to any of the plaintext bits will cause the final encrypted block to change in a way that cannot be predicted or counteracted without knowing the key to the block cipher.

To calculate the CBC-MAC of message one encrypts in CBC mode with zero initialization vector
Initialization vector

In cryptography, an initialization vector is a block of bits that is required to allow a stream cipher or a block cipher to be executed in any of several block cipher modes of operation to produce a unique stream independent from other streams produced by the same encryption key, without having to go through a re-keying process....
. The following figure sketches the computation of the CBC-MAC of a message comprising blocks using a secret key and a block cipher :

Variable-length messages

Given a secure block cipher, CBC-MAC is secure for fixed-length messages. However, by itself, it is not secure for variable-length messages. An attacker who knows the correct message-tag pairs and can generate a third message whose CBC-MAC will also be . This is simply done by XORing the first block of with and then concatenating with this modified , i.e. by making .

This problem cannot be solved by adding a message-size block (e.g., with Merkle-Damgård strengthening) and thus it is recommended to use a different mode of operation, for example, CMAC
CMAC

In cryptography, CMAC is a block cipher-based message authentication code algorithm, it may be used to provide assurance of the authenticity and, hence, the integrity of binary data....
 to protect integrity of variable-length messages.

Using the same key for encryption and authentication

One common mistake is to reuse the same key for CBC encryption and CBC-MAC. Although a reuse of a key for different purposes is a bad practice in general, in this particular case the mistake leads to a spectacular attack. Suppose that one encrypts a message in the CBC mode using an IV and gets the following ciphertext: , where . He also generates the CBC-MAC tag for the IV and the message: Now an attacker can change every bit before the last block and the MAC tag still be valid. The reason is that (this is actually the reason why people make this mistake so often—it allows to increase the performance by a factor of two). Hence as far as the last block is not changed the equivalence holds and thus the CBC-MAC tag is correct.

This example also shows that a CBC-MAC cannot be used as a collision resistant one-way function: given a key it is trivial to create a different message which “hashes” to the same tag.

See also

  • CMAC
    CMAC

    In cryptography, CMAC is a block cipher-based message authentication code algorithm, it may be used to provide assurance of the authenticity and, hence, the integrity of binary data....
     — A block-cipher–based MAC algorithm which is secure for messages of different lengths (recommended by NIST).
  • OMAC
    One-key MAC

    OMAC is a message authentication code constructed from a block cipher much like the PMAC algorithm.Officially there are two OMAC algorithms which are both essentially the same except for a small tweak....
     and PMAC
    PMAC (cryptography)

    PMAC, which stands for Parallelizable MAC, is a message authentication code algorithm. It was created by Phillip Rogaway .PMAC is a method of taking a block cipher and creating an efficient message authentication code that is provably reducible in security to the underlying block cipher....
     — Other methods to turn block ciphers into message authentication codes (MACs).
  • One-way compression function - Hash functions can be made from block ciphers. But note, there is a slight difference in function and purpose between MACs
    Message authentication code

    A cryptography message authentication code is a short piece of information used to authenticate a message.A MAC algorithm accepts as input a secret key and an arbitrary-length message to be authenticated, and outputs a MAC ....
     (such as CBC-MAC) and hashes
    Cryptographic hash function

    A cryptographic hash function is a algorithm that takes an arbitrary block of data and returns a fixed-size bit string, the hash value, such that an accidental or intentional change to the data will almost certainly change the hash value....
    .
  • DAA — A (now obsolete) U.S. government standard
    Federal Information Processing Standard

    Federal Information Processing Standards are publicly announced Standardizations developed by the United States Federal government for use by all non-military government agencies and by government contractors....
     instantiation of CBC-MAC.