1 / 7

MAC padding

Online Cryptography Course Dan Boneh. Message Integrity. MAC padding. Recall: ECBC - MAC. m[0]. m[1]. m[3]. m[4]. . . . F(k, ). F(k, ). F(k, ). F(k, ). Let F: K × X ⟶ X be a PRP Define new PRF F ECBC : K 2 × X ≤L ⟶ X .

aideen
Télécharger la présentation

MAC padding

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Online Cryptography Course Dan Boneh Message Integrity MAC padding

  2. Recall: ECBC-MAC m[0] m[1] m[3] m[4]    F(k,) F(k,) F(k,) F(k,) Let F: K × X ⟶ X be a PRP Define new PRF FECBC :K2 × X≤L ⟶ X F(k1,) tag

  3. What if msg. len. is not multiple of block-size? m[0] m[1] m[3] ??? m[4]    F(k,) F(k,) F(k,) F(k,) F(k1,) tag

  4. CBC MAC padding Bad idea: pad m with 0’s m[0] m[1] m[0] 0000 m[1] Is the resulting MAC secure? Yes, the MAC is secure It depends on the underlying MAC No, given tag on msgm attacker obtains tag on mll0 Problem: pad(m) = pad(mll0)

  5. CBC MAC padding For security, padding must be invertible ! m0 ≠ m1 ⇒ pad(m0) ≠ pad(m1) ISO: pad with “100000”. Add new dummy block if needed. • The “1” indicates beginning of pad. m[1] m[0] m[0] 100 m[1] m’[0] m’[1] m’[1] 1000…000 m’[0]

  6. CMAC (NIST standard) Variant of CBC-MAC where key = (k, k1, k2) • No final encryption step (extension attack thwarted by last keyed xor) • No dummy block (ambiguity resolved by use of k1 or k2) ⋯ ⋯ m[0] m[1] m[w] m[0] m[1] m[w] 100     k1 k2 F(k,) F(k,) F(k,) F(k,) F(k,) F(k,) tag tag

  7. End of Segment

More Related