Why not just apply hash function on the whole message? Why convert that message into blocks and hash those blocks? To avoid collisions?
Asked
Active
Viewed 2,108 times
1
-
1
- Hash != MAC 2) Most hash functions divide the message into blocks internally 3) MACs don't need to be collision resistant, and CBC-MAC isn't. 4) I don't get your questions
– CodesInChaos Jan 07 '14 at 15:57 -
possible duplicate of Can I jettison MAC if I already have SHA1(M)? – Trina Jan 07 '14 at 20:38
2 Answers
3
A hash function is not a MAC, although you can turn it into a MAC (see e.g. HMAC).
The purpose of a MAC is message authenticity / integrity -- to prevent attackers (i.e. people who don't know the secret key) from modifying the message or forging fake messages. A hash function trivially cannot fulfill the function of a MAC, because hash functions are unkeyed -- thus an attacker can always forge fake messages because they can calculate the digest of any message as easily as the legitimate parties.
With a MAC, such as CBC-MAC or HMAC, only the people who know the secret key can easily calculate the authentication 'Tag' for a given message, so if a message is sent accompanied by the correct Tag for that message then the receiver knows the message was almost certainly sent by someone who knew the key, and has not been altered (i.e. changed to a different message) in transit.
J.D.
- 4,445
- 16
- 21
-
Thanks, I understand it better now. What if an attacker gets the key? He still can't really forge the signature, right? But he now can send a message, so there'd be no origin authenticity (if there were no CBC-MAC or HMAC), right? – evening Jan 07 '14 at 16:10
-
That's what forging is (i.e. sending a message of the attacker's choice with the correct Tag). If the attacker gets the key somehow then he can forge any message he likes. – J.D. Jan 07 '14 at 16:18
-
J.D. Yeah, okay, I meant he can't tamper with Alice's and Bob's messages they sent. – evening Jan 07 '14 at 16:21
-
1@evening - you are correct, if the attacker gets the key at time T then he cannot tamper with messages sent and received prior to time T. Doing so would require both the key and a time machine. – J.D. Jan 07 '14 at 16:30
-
I am idiot. :D In this picture: http://upload.wikimedia.org/wikipedia/commons/thumb/b/bf/CBC-MAC_structure_%28en%29.svg/570px-CBC-MAC_structure_%28en%29.svg.png, by E, they mean a hash function or a block cipher encryption function? – evening Jan 07 '14 at 17:07
-
@evening CBC-MAC is based on a block cipher. In practice it's usually a better idea to use HMAC-SHA-2 instead of CBC-MAC with AES. – CodesInChaos Jan 07 '14 at 17:17
-
@evening - by E in the linked picture they mean the encryption function of a block cipher. – J.D. Jan 07 '14 at 17:19
-
-
@J.D. Just one more, sorry: what's the size of m1, m2 etc. http://upload.wikimedia.org/wikipedia/commons/thumb/b/bf/CBC-MAC_structure_%28en%29.svg/570px-CBC-MAC_structure_%28en%29.svg.png ? 1 byte? 4 bytes? – evening Jan 07 '14 at 21:36
-
@evening - the size would be the block width of the block cipher (e.g. 128 bits for AES, 64 bits for DES, etc). – J.D. Jan 07 '14 at 22:00
-
2
Hash (message digest) and MAC (message authentication code) are a different thing.
CBC-MAC turns block cipher into MAC. HMAC turns hash function into MAC.
A good reason to use CBC-MAC would be that a MAC is needed and there is a suitable implementation of sufficiently secure block cipher available.
For instance, many of recent Intel-based processors have AES implemented in instruction set. Such hardware implementation is very fast, yet relatively secure.
CBC-MAC is mainly for fixed length messages
(Important note on using CBC-MAC.)
CBC-MAC is secure for fixed-length messages (or other prefix free messages). This is restriction which is occasionally overlooked by implementors and may result in significant security hole(s). There exists a newer cipher-based MAC, known as CMAC, which does not have this restriction. CMAC is introduced in NIST Special Publication 800-38B.
user4982
- 5,319
- 20
- 32
-
1CBC-MAC is secure for prefix free messages. Fixed length is a sufficient condition, but not necessary. – CodesInChaos Jan 07 '14 at 17:52