Cipher-Based MAC - F9

[NickBrighten]

Don´t know if it an issue, but is it F9 or is it classic CBC-MAC???

F9 is based on KASUMI, while CBC-MAC is open for ciphers.

F9 architecture mitigates this threat in two ways:

1. By XOR-summing every single cipher stage output before generating the final tag, any modification or truncation of earlier blocks changes the entire evaluation map.
2. It utilizes a masking process on the final block to ensure that an attacker cannot feed the output of a short message MAC computation directly back into the system to forge an extension.

So in sum:

1. Input Parameters: The function ingests a 128-bit Integrity Key (IK), a message of variable length, a fresh count parameter (COUNT-I), a random direction bit (DIRECTION), and a random network-generated challenge (FRESH).
2. The Chaining Phase: The input elements are concatenated and segmented into fixed 64-bit blocks (M₁ to (M_{n})). The blocks are passed sequentially through a CBC chain using the KASUMI block cipher.
3. The Divergence from Standard CBC-MAC: In standard CBC-MAC, only the final block's ciphertext determines the tag. In f9, the outputs of all intermediate block encryptions are combined via an iterative XOR operation.
4. The Final Output: This accumulated XOR sum is combined with a secondary masking key (derived from the master key) and encrypted one final time through KASUMI. The result is truncated to output a 32-bit integrity tag (MAC-I).