The Security of Cipher Block Chaining

  • Authors:
  • Mihir Bellare;Joe Kilian;Phillip Rogaway

  • Affiliations:
  • -;-;-

  • Venue:
  • CRYPTO '94 Proceedings of the 14th Annual International Cryptology Conference on Advances in Cryptology
  • Year:
  • 1994

Quantified Score

Hi-index 0.00

Visualization

Abstract

The Cipher Block Chaining - Message Authentication Code (CBC MAC) specifies that a, message x = x1 ... xm be authenticated among parties who share a secret key a by tagging x with a prefix of fa(m)(x) def = fa(fa(... fa(fa(x1)驴x2)驴...驴xm-1)驴xm), where f is some underlying block cipher (eg. f = DES). This method is a pervasively used international and U.S. standard. We provide its first formal justification, showing the following general lemma: that cipher block chaining a pseudorandom function gives a pseudorandom function. Underlying our results is a technical lemma of independent interest, bounding the success probability of a computationally unbounded adversary in distinguishing between a random ml-bit to l-bit function and the CBC MAC of a random l-bit to l-bit function.