Re: [Cfrg] Building a vector-input MAC by chained construction

[Tony Arcieri <[e-mail]>]

On Tue, Dec 18, 2018 at 10:29 AM Mihir Bellare <[e-mail]> wrote:

> I may be missing something but this does not seem secure. Given the tag
> tag1 = MAC(key,x1) of a length-1 vector x1, we can compute the tag of the
> length-2 vector (x1,x2) as tag = MAC(tag1,x2).
>

This sort of "self-inflicted length extension attack" is leveraged by the
Macaroons construction by design to support an offline attenuation feature
for a credential format, with the caveat that the vector is itself a vector
of caveats. That is to say, in the context of Macaroons, extending the
vector only reduces authority, and can therefore be used by the holder of a
credential to delegate authority to a third party by passing the
credential, removing the original MAC, and adding further restrictions.
That said, ensuring Macaroon caveats only reduce authority, rather than
amplify it, is pretty much left as an exercise to the reader.

This does not seem like a desirable property in the context of a
construction like S2V.

-- 
Tony Arcieri