Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

OMAC is specified as the underlying algorithm to provide authentication within the EAX authenticated encryption (with associated data). Would that be OMAC1 or OMAC2?

If it is OMAC1, does that mean it is identical to AES-CMAC if EAX mode uses the AES block cipher as primitive?

share|improve this question
Funny enough, I think that the tag info itself kind of answers the question, but I'll let the question stand (to allow for searches). Maybe somebody can clear up how/when these terms were defined. – Maarten Bodewes Aug 26 '14 at 9:33
up vote 1 down vote accepted

Wrapping my (now deleted) comments into an answer…

OMAC, as described in the OMAC spec and its addendum, is what Rogaway et al provide security proofs for in their EAX paper. If you take a quick look at RFC 4493, you’ll notice that it states:

The National Institute of Standards and Technology (NIST) has recently specified the Cipher-based Message Authentication Code (CMAC), which is equivalent to the One-Key CBC MAC1 (OMAC1) submitted by Iwata and Kurosawa.

This already provides a good hint. But let’s see what Iwata's web page has to say about it. He should definitely know since he created that thing:

OMAC is a blockcipher-based message authentication code designed and analyzed by me and Kaoru Kurosawa.

OMAC is a simple variant of the CBC MAC (Cipher Block Chaining Message Authentication Code). OMAC stands for One-Key CBC MAC.

OMAC allows and is secure for messages of any bit length (while the CBC MAC is only secure on messages of one fixed length, and the length must be a multiple of the block length). Also, the efficiency of OMAC is highly optimized. It is almost as efficient as the CBC MAC.

``NIST Special Publication 800-38B Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication'' has been finalized on May 18, 2005. This Recommendation specifies CMAC, which is equivalent to OMAC (OMAC1).

OMAC: Brief description

OMAC is a generic name for OMAC1 and OMAC2. OMAC1 is described first. OMAC1 is equivalnent to CMAC.

(italic-bold emphasis mine, but that typo is Iwata’s… I didn’t correct it since I wanted to quote things correctly and unmodified.)

So, to answer your questions based on the above:

  1. OMAC points to OMAC1.
  2. Yes, OMAC1 is identical to AES-CMAC…

In case of doubt, simply read the relevant information in NIST SP800-38B, page 2:

Iwata and Kurosawa proposed an improvement of XCBC and named the resulting algorithm One-Key CBC-MAC (OMAC) in Ref. [6] and in Ref. [5], their initial submission to NIST; they later submitted OMAC1 [7], a refinement of OMAC, and additional security analysis [8]. The OMAC1 variation efficiently reduces the key size of XCBC. CMAC is equivalent to OMAC1.

Because CMAC is based on an approved symmetric key block cipher, such as the Advanced Encryption Standard (AES) algorithm that is specified in Federal Information Processing Standard (FIPS) Pub. 197 [3], CMAC can be considered a mode of operation of the block cipher.

(italic-bold emphasis mine)

share|improve this answer
It's always hard to argue against quotes straight from the source(s)... thanks. – Maarten Bodewes Aug 26 '14 at 17:47
Note that, in above quotations, OMAC itself seems to be a generic term for OMAC1 and OMAC2 according to Iwata and a refinement of OMAC according to NIST. I'll just call it CMAC from now on. – Maarten Bodewes Aug 26 '14 at 18:26
@owlstead Makes sense. Guess I’ll join and do the same from now on. – e-sushi Aug 26 '14 at 18:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.