We explore what happens when the basic CBC-MAC construction is used with messages of different lengths....

Transcribed Image Text:

We explore what happens when the basic CBC-MAC construction is used with messages of different lengths. (a) Say the sender and receiver do not agree on the message length in advance (and so Vrfy(m, t) = 1 iff t ² Mack (m), regardless of the length of m), but the sender is careful to only authenticate messages of length 2n. Show that an adversary can forge a valid tag on a message of length 4n. (b) Say the receiver only accepts 3-block messages (so Vrfy (m, t) = 1 only if m has length 3n and t Mack (m)), but the sender au- thenticates messages of any length a multiple of n. Show that an adversary can forge a valid tag on a new message. We explore what happens when the basic CBC-MAC construction is used with messages of different lengths. (a) Say the sender and receiver do not agree on the message length in advance (and so Vrfy(m, t) = 1 iff t ² Mack (m), regardless of the length of m), but the sender is careful to only authenticate messages of length 2n. Show that an adversary can forge a valid tag on a message of length 4n. (b) Say the receiver only accepts 3-block messages (so Vrfy (m, t) = 1 only if m has length 3n and t Mack (m)), but the sender au- thenticates messages of any length a multiple of n. Show that an adversary can forge a valid tag on a new message.

Answer rating: 100% (QA)

a Since the sender only authenticates messages of length 2n an adversary can forge a valid tag on a ... View the full answer