Шифр блок тізбегімен хабарды растау коды (CBC MAC)

Message authentication code algorithm
In cryptography, a cipher block chaining message authentication code (CBC MAC) is a technique for constructing a message authentication code (MAC) from a block cipher. The message is encrypted with some block cipher algorithm in cipher block chaining (CBC) mode to create a chain of blocks such that each block depends on the proper encryption of the previous block. This interdependence ensures that a change to any of the plaintext bits will cause the final encrypted block to change in a way that cannot be predicted or counteracted without knowing the key to the block cipher. To calculate the CBC MAC of message m, one encrypts m in CBC mode with zero initialization vector and keeps the last block. The following figure sketches the computation of the CBC MAC of a message comprising blocks using a secret key k and a block cipher E:
CBC MAC on its own is not secure for variable length messages and TLS 1.2, as well as Bluetooth Low Energy (as of Bluetooth 4.0, see NIST SP 800 121 Rev2). It is available for TLS 1.3, but not enabled by default in OpenSSL. CBC MAC is also used as a "conditioning component" (a. k. a. randomness extractor, a method to generate bitstrings with full entropy) in NIST SP 800 90B.

FIPS PUB 113 Computer Data Authentication is a (now obsolete) U. S. government standard that specified the CBC MAC algorithm using DES as the block cipher. The CBC MAC algorithm is also included into ANSI X9.9, ANSI X9.19, ISO 8731 1, and ISO/IEC 9797 1 MAC (Algorithm 1).

If the block cipher used is secure (meaning that it is a pseudorandom permutation), then CBC MAC is secure for fixed length messages. However, by itself, it is not secure for variable length messages. Thus, any single key must only be used for messages of a fixed and known length. This is because an attacker who knows the correct authentication tag (i. e. CBC MAC) pairs for two messages and can generate a third message whose CBC MAC will also be This is simply done by XORing the first block of with t and then concatenating m with this modified ; i. e., by making When computing the MAC for the message , it follows that we compute the MAC for m in the usual manner as t, but when this value is chained forwards to the stage computing we will perform an exclusive OR operation with the value derived for the MAC of the first message. The presence of that tag in the new message means it will cancel, leaving no contribution to the MAC from the blocks of plain text in the first message m: and thus the tag for is
This problem cannot be solved by adding a message size block to the end. in fact CBC MAC has been proven secure as long as no two messages that are prefixes of each other are ever used and prepending the length is a special case of this. This can be problematic if the message length may not be known when processing begins.

Encrypt last block CBC MAC (ECBC MAC) is defined as Compared to the other discussed methods of extending CBC MAC to variable length messages, encrypt last block has the advantage of not needing to know the length of the message until the end of the computation.

As with many cryptographic schemes, naïve use of ciphers and other protocols may lead to attacks being possible, reducing the effectiveness of the cryptographic protection (or even rendering it useless). We present attacks which are possible due to using the CBC MAC incorrectly.

When encrypting data using a block cipher in cipher block chaining (or another) mode, it is common to introduce an initialization vector to the first stage of the encryption process. It is typically required that this vector be chosen randomly (a nonce) and that it is not repeated for any given secret key under which the block cipher operates. This provides semantic security, by means of ensuring the same plain text is not encrypted to the same cipher text, allowing an attacker to infer a relationship exists. When computing a message authentication code, such as by CBC MAC, the use of an initialization vector is a possible attack vector. In the operation of a ciphertext block chaining cipher, the first block of plain text is mixed with the initialization vector using an exclusive OR The result of this operation is the input to the block cipher for encryption. However, when performing encryption and decryption, we are required to send the initialization vector in plain text typically as the block immediately preceding the first block of cipher text such that the first block of plain text can be decrypted and recovered successfully. If computing a MAC, we will also need to transmit the initialization vector to the other party in plain text so that they can verify the tag on the message matches the value they have computed. If we allow the initialization vector to be selected arbitrarily, it follows that the first block of plain text can potentially be modified (transmitting a different message) while producing the same message tag. Consider a message In particular, when computing the message tag for CBC MAC, suppose we choose an initialization vector such that computation of the MAC begins with This produces a (message, tag) pair
Now produce the message For each bit modified in , flip the corresponding bit in the initialization vector to produce the initialization vector It follows that to compute the MAC for this message, we begin the computation by As bits in both the plain text and initialization vector have been flipped in the same places, the modification is cancelled in this first stage, meaning the input to the block cipher is identical to that for If no further changes are made to the plain text, the same tag will be derived despite a different message being transmitted. If the freedom to select an initialization vector is removed and all implementations of CBC MAC fix themselves on a particular initialization vector (often the vector of zeroes, but in theory, it could be anything provided all implementations agree), this attack cannot proceed. To sum up, if the attacker is able to set the IV that will be used for MAC verification, he can perform arbitrary modification of the first data block without invalidating the MAC.