Show that the CBC MAC we studied is not UF-CMA secure if the domain contains messages of arbitrary length (but multiple of n bits), where n is the underlying block cipher’s block length.
PROOF
Given:
- Encryption Scheme: CBC MAC
- Message Space (MsgSp): Messages of arbitrary length (multiple of n bits)
- Key Space (KeySp): Not specified
Proof
Attack: Consider an UF-CMA adversary who submits the following LR query: (M0, M1) and gets Tag. The adversary then applies the following algorithm:
Submit a new message M' = M0||M1||M2, where M2 is an arbitrary block.
Justification: The adversary can append an arbitrary block to the given messages M0 and M1 without affecting the validity of the tag. This allows the adversary to forge new valid tags for messages not previously queried.
Advantage: AdvUF-CMA (A) = 1, as the adversary can always forge a valid tag with a new message.
Resources: The resources required for this attack are reasonable; t: time to compute the tag, q: 1, µ: 2n, so reasonable resources.
EXAMPLE: ECB IS NOT IND-CPA
Given:
- MsgSp = {0,1}^l * N = bitstring of length some multiple of l-sized blocks
- KeySp = {0,1}^k = bitstring of length k
- E: EK(Mi) = Ci where M = M1||M2||...||MN and C = C1||C2||...||CN
- D: EK-1(Ci) = Mi where M = M1||M2||...||MN and C = C1||C2||...||CN
- If Ma = Mb then Ca = Cb
Proof
Attack: Consider an IND-CPA adversary who submits the following LR query: (02n, 0n||1n) and gets C1||C2. The adversary then applies the following algorithm:
If C1 = C2 then:
Return left
Else:
Return right
Justification: If 2 message blocks are the same then their ciphertexts are the same. Here we put in a left message with 2 identical blocks, which will result in 2 identical ciphertext blocks, and a right message with 2 completely different blocks, which will result in 2 different ciphertext blocks. An adversary knowing this behavior can check if the 2 ciphertext blocks are identical or not and easily determine if it is the left or right query.
Advantage: AdvECB (A) = 1
Resources: t: time to compare n bits, q: 1, µ: 4n, so reasonable resources.