From Wikipedia, the free encyclopedia

CBC-MAC stands for Cipher Block Chaining Message Authentication Code. This utilizes block ciphers in CBC mode to create a message authentication code. By encrypting a given plaintext with some block cipher algorithm in CBC mode, we can create a chain of blocks, such that each block is dependent on the proper encryption of the block before it. Since there is this interdependence, we can use this to ensure that none of the plaintext bits that were input into the encryption have been changed, thus creating the message authentication code.

To calculate the CBC-MAC of message m one should encrypt m in CBC mode with zero initialization vector. The following figure sketches the computation of the CBC-MAC of a message comprising blocks using a secret key k and a block cipher E:

Contents 1 Variable-length messages 2 Using the same key for encryption and authentication 3 See also 4 References

Given a secure block cipher, CBC-MAC is secure for fixed-length messages. However, by itself, it is not secure for variable-length messages. This problem cannot be solved by adding a message-size block (e.g., with MD strengthening) and thus it is recommended to use a different mode of operation, for example, CMAC to protect integrity of variable-length messages.

Let us show a possible attack. An attacker does not know the key k, but she can ask to calculate the CBC-MAC tag of any message; her goal is to produce a MAC for some new message. The simplest attack is to use two message-tag pairs (m,t) and (m',t'), where the single-block message m and m' can be random, and to produce This is a correct message-tag pair because the CBC-MAC of is whereas E(m) = t and E(m') = t', and thus

One common mistake is to reuse the same key k for CBC encryption and CBC-MAC. Although a reuse of a key for different purposes is a bad practice in general, in this particular case the mistake leads to a spectacular attack. Suppose that one encrypts a message in the CBC mode using an IV c _{− 1} and gets the following ciphertext: , where . He also generates the CBC-MAC tag for the IV and the message: Now an attacker can change every bit before the last block c_{x − 1} and the MAC tag still be valid. The reason is that (this is actually the reason why people do this mistake so often—it allows to increase the performance by a factor of two). Hence as far as the last block is not changed the equivalence t = c_{x − 1} holds and thus the CBC-MAC tag is correct.

This example also shows that a CBC-MAC cannot be used as a collision resistant one-way function: Given a key it is trivial to create a different message which “hashes” to the same tag.

• CMAC — A block-cipher–based MAC algorithm which is secure for messages of different lengths (recommended by NIST).
• OMAC and PMAC — Other methods to turn block ciphers into message authentication codes (MACs).
• Hash functions based on block ciphers — Note, there is a slight difference in function and purpose between MACs (such as CBC-MAC) and hashes.
• DAA — A (now obsolete) U.S. government standard instantiation of CBC-MAC.

1. ISO/IEC 9797-2:2002
2. The security of the cipher block chaining message authentication code.

Cryptographic hash functions and Message authentication codes (MACs) v • d • e
Hash algorithms: Gost-Hash | HAS-160 | HAS-V | HAVAL | MDC-2 | MD2 | MD4 | MD5 | N-Hash | RadioGatún | RIPEMD | SHA family | Snefru | Tiger | VEST | WHIRLPOOL | crypt(3) DES
MAC algorithms: DAA | CBC-MAC | HMAC | OMAC/CMAC | PMAC | UMAC | Poly1305-AES | VEST
Authenticated encryption modes: CCM | EAX | GCM | OCB | VEST   Attacks: Birthday attack | Collision attack | Preimage attack | Rainbow table | Brute force attack
Standardization: CRYPTREC | NESSIE   Misc: Avalanche effect | Hash collision | Hash functions based on block ciphers
Cryptography v • d • e
History of cryptography | Cryptanalysis | Cryptography portal | Topics in cryptography
Symmetric-key algorithm | Block cipher | Stream cipher | Public-key cryptography | Cryptographic hash function | Message authentication code | Random numbers