Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

How does padding in PMAC work? I have been told two stories: Firstly, I have been told that it works similar to CMAC padding, and secondly, I have been told that it does not need padding.

I find the second story very strange as I think one could make an existential forger quite easily. But if PMAC pads like CMAC, then surely we would need another key.

TL;DR I don't know how padding in PMAC works, please can someone explain.

Thanks Barry

share|improve this question

1 Answer 1

Obviously, PMAC needs a padding because you want to be able to compute MACs of messages which are not multiple of the block length. The padding is defined in the PMAC paper http://www.cs.ucdavis.edu/~rogaway/ocb/pmac.pdf, it simply complete the last block adding a single '1' bit and as many '0' bits as needed.

Note that messages whose length are multiples of the block length are not padded. As a consequence, to preserve security, the treatment of the final block is different for the two types of messages. More precisely, before the final encryption an additional key-dependent value is XORed in. See the above paper for full details.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.