Are deployed MACs IND-CPA? There are a number of message authentication codes (MACs) used in practice. They are highly used in practice (f.ex. in TLS), but there's (at least) one application where they can't be used: Full Disk Encryption (FDE).

Now most FDE applications just don't bother with authentication. TrueCrypt for example has no authentication mechanism in place for authenticating the bulk data. However it uses CRC-32 (!) to ensure integrity of the data encryption keys in the header. The advantage this provides is that the ciphertext may be completely indistuingishable from random.

Now I want to create a data container format with the same property (complete file is random-looking) but want to perform strong authentication of the data encryption keys. This means I need to use authenticated encryption (AE).

Most of the AE schemes append a tag to the ciphertext and to ensure pseudorandomness of the whole file this tag also has to be random looking. The desired notion for this would be IND-CPA.

So my question:
Are the output tags of the common MACs / AE-modes indistinguishable from random data under chosen plaintext (or eavesdropper?) attacks?

What is considered common MACs / AE-modes:


GCM
EAX
CWC
HMAC
CMAC / CCM
The property you are probably looking for is whether the MACs are PRF.

With HMAC it depends on the pseudo-randomness of the hash function used. If the hash is a PRF then the HMAC is as well. However, that is not required for MAC security of HMAC, so it's not necessarily true even with a secure HMAC. See New Proofs for NMAC and HMAC: Security without Collision-Resistance.

In both of EAX and CMAC, the MAC is a particular (unique) output of the block cipher and is indistinguishable from random as long as the block cipher is a PRP and the outputs are not seen too many times to distinguish a PRP from a PRF.

Similarly, GCM outputs the XOR of a unique block cipher output with the GHASH and so is PRF as long as the block cipher is. (You also have to assume that the GHASH output is independent of the block cipher output.)

CWC has a Carter-Wegman MAC that is again indistinguishable as long the block cipher is, because it outputs a XOR of two independent block cipher outputs.