Authenticating a message with HMAC vs AES-CBC Given some string s I want to sign, are following methods are equivalent to produce message with signature, assuming it does not matter whether s is visible in message or not?


s + HMAC(s, secret_key)
AES_CBC(s + string_of_zeroes, secret_key)


And validation:


recalculate HMAC of first part of message and compare it to second one
decrypt message and verify that it ends with string_of_zeroes


If that is true, string_of_zeroes of what length should be taken to make them equivalent?
Given some string s I want to [integrity protect], are following methods are equivalent to produce message with signature, assuming it does not matter whether s is visible in message or not?


Absolutely not; with AES_CBC, if the attacker modifies one particular block of the ciphertext, then the decryption of the modified ciphertext will have two blocks modified (the one corresponding to the modified block, and one block after that).

Hence, if s is (at least) two blocks long, an attacker can freely modify the first block of the ciphertext; the decryption will still have the string of zeros still in place (as that wasn't modified), and so the attacker has succeeded in undetectably modifying the string.

If you need a MAC, use a MAC (alternatively, authenticated encryption).  And, make sure that a MAC is appropriate (that is, both the sender and the receiver share a secret key, and you don't mind if the receiver were able to generate valid-looking messages of his own).