Construction of a MAC with decryption mode of a block cipher Assume we have a hardware device with build-in AES decryption and support for ECB and CBC mode (but no support for AES encryption). It only receives data and decrypts it. Minor modifications of the hardware are still possible, but you can't add AES encryption.

Now assume we want to add a MAC for ensuring integrity. CBC-MAC can't be used, as it requires the encryption mode of the block cipher.

Are there MACs you can construct with only the decryption mode of a block cipher?

I thought about using the CBC-MAC scheme and simply replace the AES encryption with the AES decryption, but I'm not sure this would result in a secure MAC.
A block cipher is a (strong) pseudorandom permutation. As such, it makes no difference if you compute it in the forward or in the backward direction. Thus, you can use AES in decryption mode and it has exactly the same security as AES in encryption mode, as a block cipher. Therefore, you can do CBC-MAC with AES decryption and you are fine.

Two remarks:


Make sure you use an independent key for the CBC-MAC (and not the same as the encryption), and
You should use CMAC and not straight CBC-MAC.