Let = (Gen, M ac, V er) be is a secure MAC for fixed-length messages of n bits, and H : {0, 1} {0, 1} n be a collision-resistant hash function. Consider the following MAC 0 = (Gen0 , M ac0 , V er0 ) for arbitrary length messages from the lecture: Gen0 = Gen For a key k: M ac0 (m, k) = M ac(H(m), k) For a key k, message m0 , and t 0 : V er(m0 , t0 , k) = 1 if and only if M ac(H(m0 ), k) = t 0 . Prove that 0 is a secure MAC for arbitrary length messages.

Security of the Hash-and-Mac paradigm Let (Gen. Mac, Ver) be is a secure MAC for fixed-length messages of n bits, and H : {0.1}* {0,1)" be a collision-resistant hash function. Consider the following MAC 11, = (G : . . . en,, 1ad Ver') for arbitrary length messages from the lecture Gen'=Gen For a key k: Mac,(m, k) = Mac(H(m), k) For a key k, message m. and t': Ver(m. t, k) = l if and only if Mac(H(m) k) = t. Prove that 11, is a secure MAC for arbitrary length messages. Security of the Hash-and-Mac paradigm Let (Gen. Mac, Ver) be is a secure MAC for fixed-length messages of n bits, and H : {0.1}* {0,1)" be a collision-resistant hash function. Consider the following MAC 11, = (G : . . . en,, 1ad Ver') for arbitrary length messages from the lecture Gen'=Gen For a key k: Mac,(m, k) = Mac(H(m), k) For a key k, message m. and t': Ver(m. t, k) = l if and only if Mac(H(m) k) = t. Prove that 11, is a secure MAC for arbitrary length messages