Question: You have a software for a deterministic message authentication code MAC = (K, T) that is known to be UF-CMA secure under some reasonable

You have a software for a deterministic message authentication code MAC = (K, T) that is known to be UF-CMA 

You have a software for a deterministic message authentication code MAC = (K, T) that is known to be UF-CMA secure under some reasonable assumptions. However, the message space for this MAC is only the set of messages up to 1MB long. At some point, you needed to authenticate messages of length more than 1MB but less than 2MB. So you decide to use the existing software from now on in the following way: The new key generation algorithm K' runs K twice and outputs the concatenated outputs of the latter. To MAC a message M, break it into equal parts M, M (for simplicity, let's assume that all messages have even length), take the key K || K and let the tag be TK (M) TK (M) Let's call the modified scheme MAC' = (K', T'). (a) Prove that MAC' is not UF-CMA secure. (b) Give a one or two line justification of why MAC' is not a PRF.

Step by Step Solution

3.34 Rating (148 Votes )

There are 3 Steps involved in it

1 Expert Approved Answer
Step: 1 Unlock

Answer Consider an adversary who wants to forge a valid tag for a message M by exploiting the fact t... View full answer

blur-text-image
Question Has Been Solved by an Expert!

Get step-by-step solutions from verified subject matter experts

Step: 2 Unlock
Step: 3 Unlock

Students Have Also Explored These Related Programming Questions!