HOMEMADE Question: Achieving Rivest's private-key encryption from a Mac
Provide a security definition of a Mac that makes the (bit-by-bit) private-key encryption scheme that Rivest described secure in the sense of indistinguishability in the presence of an eavesdropper.
[5%]
4.7 Let F be a pseudorandom function. Show that the following MAC for messages of length 2n is insecure: Gen outputs a uniform k e{0,1} To authenticate a message m|[m with[m=|m|=n,compute the tagFmFFm2
4.13 We explore what happens when the basic CBC-MAC construction is used with messages of different lengths.
[5%]
a Say the sender and receiver do not agree on the message length in advance and so Vrfymt=1 iff t=Macm,regardless of the length of m, but the sender is careful to only authenticate messages of length 2n. Show that an adversary can forge a valid tag on a message of length 4n. b Say the receiver only accepts 3-block messages so Vrfym,t=1 only if m has length 3n and tMacm), but the sender au- thenticates messages of any length a multiple of n. Show that an adversary can forge a valid tag on a new message.
[5%]
4.14 Prove that the following modifications of basic CBC-MAC do not yield a secure MAC (even for fixed-length messages) (b) A random initial block is used each time a message is authenticated That is, change Construction 4.9 by choosing uniform to {0,1} computing t as before, and then outputting the tag to,te); verification is done in the natural way.
[5%]
4.27 Define an appropriate notion of a e-secure two-time MAC, and give a construction that meets your definition.
HOMEMADE Question: Achieving Rivest's private-key encryption from a Mac
Provide a security definition of a Mac that makes the (bit-by-bit private-key encryption scheme that Rivest described secure in the sense of indistinguishability in the presence of an eavesdropper.
[5%]
