I'm looking at the CBC-MAC vulnerabilities that arise when CBC-MAC is used incorrectly, specifically when the keys for encryption and authentication are reused. The source I'm relying on is the Wikipedia Article on the matter (https://en.wikipedia.org/wiki/CBC-MAC#Using_the_same_key_for_encryption_and_authentication).
There are some odd omissions that I fail to understand. For one, it says CBC-MAC is used with IV = 0 and let's assume we reuse the key for authentication using CBC-MAC and encryption using CBC. If the MAC of the encryption is not zero, then the attack does not work at all, right? As far as I understand, the attack only works if
- Plaintext is authenticated, not ciphertext
- Encryption key and authentication key are identical
- Encryption IV and authentication IV are identical
I.e., I really fail to understand what the attack is. Obviously, if everything is identical, then the last ciphertext block is also going to be identical (which is the auth tag of CBC-MAC). Does this really only work with all those broken assumptions or is there something I'm missing?