Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How does padding in PMAC work? I have been told two stories: Firstly, I have been told that it works similar to CMAC padding, and secondly, I have been told that it does not need padding.

I find the second story very strange as I think one could make an existential forger quite easily. But if PMAC pads like CMAC, then surely we would need another key.

TL;DR I don't know how padding in PMAC works, please can someone explain.

share|improve this question

Obviously, PMAC needs a padding because you want to be able to compute MACs of messages which are not multiple of the block length. The padding is defined in the PMAC paper, it simply complete the last block adding a single '1' bit and as many '0' bits as needed.

Note that messages whose length are multiples of the block length are not padded. As a consequence, to preserve security, the treatment of the final block is different for the two types of messages. More precisely, before the final encryption an additional key-dependent value is XORed in. See the above paper for full details.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.