CBC MACs for arbitrary-length messages: The three-key constructions
We suggest some simple variants of the CBC MAC that enable the efficient authentication of arbitrary-length messages. Our constructions use three keys, K 1, K2, K3, to avoid unnecessary padding and MAC any message M is an element of {0, 1}* using max( 1, [\M\\n]} applications of the underlying n-bit block cipher. Our favorite construction, XCBC, works like this: if \M\ is a positive multiple of n then XOR the n-bit key K 2 with the last block of M and compute the CBC MAC keyed with K 1; otherwise, extend M's length to the next multiple of n by appending minimal 10(l) padding (l >= 0), XOR the n-bit key K3 with the last block of the padded message, and compute the CBC MAC keyed with K 1. We prove the security of this and other constructions, giving concrete bounds on an adversary's inability to forge in terms of his inability to distinguish the block cipher from a random permutation. Our analysis exploits new ideas which simplify proof, compared with prior work.
cbc mac message authentication codes modes of operation provable security standards