Re: [Cfrg] Building a vector-input MAC by chained construction

Tony Arcieri <> Tue, 18 December 2018 18:41 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 3166A1311C1 for <>; Tue, 18 Dec 2018 10:41:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id at8h7FSswdx6 for <>; Tue, 18 Dec 2018 10:40:59 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:4864:20::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 6A1FD1311BE for <>; Tue, 18 Dec 2018 10:40:59 -0800 (PST)
Received: by with SMTP id y23so2803082oia.4 for <>; Tue, 18 Dec 2018 10:40:59 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=cbP00drh254nKGT9wdnIk+XcCaOCyrG0J/IuvZ5VW8k=; b=Ii2A6y16XHGjayBv8O6011U8imDAo2wlW0kphUYdjY7Z5gI9p15Rwmqdt36QC4eSzt Edoh5eXYHu1mW+QhvUZ5WrXK/HvoFyf9ElWZC97Z1w+0a4r2KWk26eBxeYpkdOhy2Bjy xJFRgT0eKn7px0jA2VjMx4Y3vyuOxjGH/C8KzZL1LtuQ6AbpcqQ4amMXdEOGjRzoWos5 uGKlF3eC+IV8Eyw9PErd2pVnr4DJmB6ZIb5NucqfomLmtUUL1wPmL0OJNSzs0/5WjvZE SAYTMDfVtLVWRdhZl7oUeX/C/ag3xgL7KqdXO/nMm24/IC7huXgN5uSPezZJD4i+OLCX JASA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=cbP00drh254nKGT9wdnIk+XcCaOCyrG0J/IuvZ5VW8k=; b=qVRtzowQumDwUw8bUFunx0ElZwjwlaSB2LS/mYyk+wE4S2bqROiSPEVr3kjznEw3kq 4X3JDQ78OTI8TiIZJx3XHVeUua4AyG3davfgZUuTzTHoS5hOwStuMBRhQ+XlyGKoxPqc W381EC5QOewuDzKp5LsXrhYskpe0jMDuBCCrcXuV1Gx/mLQSFVnYbzKQCIDlsxV7lETq xszo/qAzlqRrumccSX/t8TB1neqyzwyHAsD6CBoG/XBSCidyRAzwykiorRWtYB3T5XKr GD/xhvu3oqu6zN4MLJlFn9jh364QQ0v2s+/tPidMocXvQf4ZAR1e+gqIMUWy5Paln/nI IfDg==
X-Gm-Message-State: AA+aEWZgofQdTlgZHLr93XPjOuJYluojERpCbhNcciTk2bw9kTP8ojjp nKlOGjybzRdkrCli0Hv1tzz9ohO2M/LJI3CDq28=
X-Google-Smtp-Source: AFSGD/WQQXyMSWzig9eVtgx/oIfNBvoVPIfgHllesv1i5hacjzNrVJMFYiFLL60w4/ghiYWS6A5LOx0OQ5aLp+PjG9M=
X-Received: by 2002:aca:bd41:: with SMTP id n62mr8839269oif.348.1545158458589; Tue, 18 Dec 2018 10:40:58 -0800 (PST)
MIME-Version: 1.0
References: <> <>
In-Reply-To: <>
From: Tony Arcieri <>
Date: Tue, 18 Dec 2018 10:40:47 -0800
Message-ID: <>
To: Mihir Bellare <>
Cc: Neil Madden <>,
Content-Type: multipart/alternative; boundary="0000000000000bc7c5057d503d3e"
Archived-At: <>
Subject: Re: [Cfrg] Building a vector-input MAC by chained construction
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 18 Dec 2018 18:41:01 -0000

On Tue, Dec 18, 2018 at 10:29 AM Mihir Bellare <> wrote:

> I may be missing something but this does not seem secure. Given the tag
> tag1 = MAC(key,x1) of a length-1 vector x1, we can compute the tag of the
> length-2 vector (x1,x2) as tag = MAC(tag1,x2).

This sort of "self-inflicted length extension attack" is leveraged by the
Macaroons construction by design to support an offline attenuation feature
for a credential format, with the caveat that the vector is itself a vector
of caveats. That is to say, in the context of Macaroons, extending the
vector only reduces authority, and can therefore be used by the holder of a
credential to delegate authority to a third party by passing the
credential, removing the original MAC, and adding further restrictions.
That said, ensuring Macaroon caveats only reduce authority, rather than
amplify it, is pretty much left as an exercise to the reader.

This does not seem like a desirable property in the context of a
construction like S2V.

Tony Arcieri