Cipher-Based MAC - F9 #806

New issue

Open

opened 2026-09-04 10:10:51 -05:00 by NickBrighten · 0 comments

NickBrighten commented

2026-09-04 10:10:51 -05:00

(Migrated from github.com)

Don´t know if it an issue, but is it F9 or is it classic CBC-MAC???

F9 is based on KASUMI, while CBC-MAC is open for ciphers.

F9 architecture mitigates this threat in two ways:

By XOR-summing every single cipher stage output before generating the final tag, any modification or truncation of earlier blocks changes the entire evaluation map.
It utilizes a masking process on the final block to ensure that an attacker cannot feed the output of a short message MAC computation directly back into the system to forge an extension.

So in sum:

Input Parameters: The function ingests a 128-bit Integrity Key (IK), a message of variable length, a fresh count parameter (COUNT-I), a random direction bit (DIRECTION), and a random network-generated challenge (FRESH).
The Chaining Phase: The input elements are concatenated and segmented into fixed 64-bit blocks (M₁ to M_{n}). The blocks are passed sequentially through a CBC chain using the KASUMI block cipher.
The Divergence from Standard CBC-MAC: In standard CBC-MAC, only the final block's ciphertext determines the tag. In f9, the outputs of all intermediate block encryptions are combined via an iterative XOR operation.
The Final Output: This accumulated XOR sum is combined with a secondary masking key (derived from the master key) and encrypted one final time through KASUMI. The result is truncated to output a 32-bit integrity tag (MAC-I).

Don´t know if it an issue, but is it F9 or is it classic CBC-MAC??? F9 is based on KASUMI, while CBC-MAC is open for ciphers. F9 architecture mitigates this threat in two ways: 1. By XOR-summing every single cipher stage output before generating the final tag, any modification or truncation of earlier blocks changes the entire evaluation map. 2. It utilizes a masking process on the final block to ensure that an attacker cannot feed the output of a short message MAC computation directly back into the system to forge an extension. So in sum: 1. Input Parameters: The function ingests a 128-bit Integrity Key (IK), a message of variable length, a fresh count parameter (COUNT-I), a random direction bit (DIRECTION), and a random network-generated challenge (FRESH). 2. **The Chaining Phase**: The input elements are concatenated and segmented into fixed 64-bit blocks (M₁ to \(M_{n}\)). The blocks are passed sequentially through a CBC chain using the KASUMI block cipher. 3. **The Divergence from Standard CBC-MAC**: In standard CBC-MAC, only the final block's ciphertext determines the tag. In f9, the outputs of all intermediate block encryptions are combined via an iterative XOR operation. 4. **The Final Output**: This accumulated XOR sum is combined with a secondary masking key (derived from the master key) and encrypted one final time through KASUMI. The result is truncated to output a 32-bit integrity tag (MAC-I).