Difference between CBC-MAC and CMAC

According to Wikipedia, CMAC is based on a variation of CBC-MAC and fixes some security deficiencies in it. However, I could not find a simple and clear explanation of what the differences between the two algorithms actually are, so I thought I'd ask here:

How does CMAC differ from CBC-MAC, and why?

-
– Ricky Demer Jan 12 '14 at 1:00
As Ricky notes, wikipedia already tries to solve your problem. Perhaps (as a sign of prior research and to help future readers) you could update your question clarifying why this is not sufficient? – figlesquidge Jan 12 '14 at 2:36
@figlesquidge: While the information requested probably is obtainable from Wikipedia, it's not very clearly presented there. IMO, this is a perfectly good reference question, and I'm hoping to see a concise and comprehensive answer summarizing the main differences. – Ilmari Karonen Jan 12 '14 at 6:46
@IlmariKaronen : that is exactly what I am looking for. Actually, I also didn't found any good visual representation of the CMAC algorithm compared with the CBC-MAC. Also, Wikipedia is not always the best in describing cryptography concepts. – enigma Jan 12 '14 at 10:05
Sorry, perhaps I should have written "where this is not clear" or similar rather than 'sufficient'. – figlesquidge Jan 12 '14 at 13:10

The problem with CBC-MAC for variable-length messages is that CBC-MAC applied to a one-block message essentially amounts to an oracle for evaluating the block cipher at values of the adversary's choice. And that oracle allows an adversary to break the scheme.

Consider first CMAC restricted to messages that consist of a whole number of blocks. Then the difference between CMAC and CBC-MAC is that CMAC xors the final block with a secret value - you could call it a tweak - (carefully) derived from the key before applying the block cipher. This ensures that the final block is treated differently from the other blocks, which in turn means that the adversary no longer has an oracle for evaluating the block cipher at values of his choice.

To make CMAC work for messages that do not consist of a whole number of blocks, CMAC (carefully) derives a second secret value. CMAC first pads the message so that it contains a whole number of blocks, then the second secret is xored with the final (padded) block before the block cipher is applied.

This extra complication could be avoided by always padding the message, but by not doing that, CMAC saves a block cipher evaluation for a significant fraction of all possible messages.

The secret values are derived by applying the block cipher to the all-zero block and then shifting the bit values (sometimes xoring bits into the low-order bits to get a finite field multiplication).

-
Could it be possible to provide a graphic pointing to that difference please ? – enigma Jan 12 '14 at 15:51
Awesome, I got it now. Thank you for your help! – enigma Jan 12 '14 at 21:57