Slide $9$

I C$$S

Basic CBC$-$MAC

C$$SPECC

The Institute for Cyber Security

Variable Length MessageS to get on enge

Fks

Fks

Fk$1$

t$1$

F$\text{'}$k$2$

Characteristics

$$Need $2$ shared keys

$$In general can generate additional keys from a single shared key k

K$1=$ F$<(1)$

K$2=$ F$(2)$

Question $1$

Consider the Basic CBC$-$MAC in slide $9$ of module $4\mathrm{.}3,$ with a block cipher having a $128-$bit key and $128-$bit block length to MAC a $2048-$bit message. How many evaluations of the block cipher will be performed to calculate the tag? Explain.

$[$Assume there is no padding$]$

Question $2$

How many symmetric key bits are required for the MAC construction in question $1?$ Explain.

Slide $8$

The CCA indistinguishability experiment PrivKca

$,($n$)$:

$$A key k is generated by running Gen$(1").$

$$A is given input $1"$ and oracle access to Enck$(.)$ and Deck$().$

It outputs a pair of equal$-$length messages mo$,$ m$1.$

$$A uniform bit b E $\{0,1\}$ is chosen, and then a challenge ci$-$phertext c $<$ Enc$($mb$)$ is computed and given to A$.$

$$The adversary A continues to have oracle access to Enck$()$ and Deck$(.),$ but is not allowed to query the latter on the challenge ciphertext itself. Eventually, A outputs a bit b$\text{'}.$

$$The output of the experiment is $1$ if b$\text{'}=$b$,$ and $0$ otherwise.

If the output of the experiment is $1,$ we say that A succeeds.

Question $3$

Consider the CCA Indistinguishability Experiment in slide $8,$ module $5\mathrm{.}1.$ In step $4$ the adversary is not allowed to query the decryption oracle with the challenge ciphertext from step $3$ as the input. Explain how the adversary A will succeed if this restriction was omitted.

Question $4$

Suppose we use the CBC mode of slide $10,$ module $3\mathrm{.}9$ for encryption and the CBC$-$MAC of slide $7$ module $4\mathrm{.}3.$ Consider a $2-$block plaintext message m$.$ How many evaluations of Fk will be needed for the three cases discussed in module $5\mathrm{.}2$: $($i$)$ encrypt and authenticate, $($ii$)$ authenticate then encrypt, and $($iii$)$ encrypt then authenticate.

Plz do not use chat gpt or gemini thank you need short ans