Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

According to Wikipedia, CMAC is based on a variation of CBC-MAC and fixes some security deficiencies in it. However, I could not find a simple and clear explanation of what the differences between the two algorithms actually are, so I thought I'd ask here:

How does CMAC differ from CBC-MAC, and why?

share|improve this question
2  
en.wikipedia.org/wiki/CMAC $\;$ –  Ricky Demer Jan 12 at 1:00
    
As Ricky notes, wikipedia already tries to solve your problem. Perhaps (as a sign of prior research and to help future readers) you could update your question clarifying why this is not sufficient? –  figlesquidge Jan 12 at 2:36
2  
@figlesquidge: While the information requested probably is obtainable from Wikipedia, it's not very clearly presented there. IMO, this is a perfectly good reference question, and I'm hoping to see a concise and comprehensive answer summarizing the main differences. –  Ilmari Karonen Jan 12 at 6:46
    
@IlmariKaronen : that is exactly what I am looking for. Actually, I also didn't found any good visual representation of the CMAC algorithm compared with the CBC-MAC. Also, Wikipedia is not always the best in describing cryptography concepts. –  enigma Jan 12 at 10:05
    
Sorry, perhaps I should have written "where this is not clear" or similar rather than 'sufficient'. –  figlesquidge Jan 12 at 13:10

1 Answer 1

up vote 5 down vote accepted

The problem with CBC-MAC for variable-length messages is that CBC-MAC applied to a one-block message essentially amounts to an oracle for evaluating the block cipher at values of the adversary's choice. And that oracle allows an adversary to break the scheme.

Consider first CMAC restricted to messages that consist of a whole number of blocks. Then the difference between CMAC and CBC-MAC is that CMAC xors the final block with a secret value - you could call it a tweak - (carefully) derived from the key before applying the block cipher. This ensures that the final block is treated differently from the other blocks, which in turn means that the adversary no longer has an oracle for evaluating the block cipher at values of his choice.

Simplified CMAC diagram

To make CMAC work for messages that do not consist of a whole number of blocks, CMAC (carefully) derives a second secret value. CMAC first pads the message so that it contains a whole number of blocks, then the second secret is xored with the final (padded) block before the block cipher is applied.

This extra complication could be avoided by always padding the message, but by not doing that, CMAC saves a block cipher evaluation for a significant fraction of all possible messages.

The secret values are derived by applying the block cipher to the all-zero block and then shifting the bit values (sometimes xoring bits into the low-order bits to get a finite field multiplication).

share|improve this answer
    
Could it be possible to provide a graphic pointing to that difference please ? –  enigma Jan 12 at 15:51
    
Awesome, I got it now. Thank you for your help! –  enigma Jan 12 at 21:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.