According to Wikipedia, CMAC is based on a variation of CBC-MAC and fixes some security deficiencies in it. However, I could not find a simple and clear explanation of what the differences between the two algorithms actually are, so I thought I'd ask here:
How does CMAC differ from CBC-MAC, and why?
The problem with CBC-MAC for variable-length messages is that CBC-MAC applied to a one-block message essentially amounts to an oracle for evaluating the block cipher at values of the adversary's choice. And that oracle allows an adversary to break the scheme.
Consider first CMAC restricted to messages that consist of a whole number of blocks. Then the difference between CMAC and CBC-MAC is that CMAC xors the final block with a secret value - you could call it a tweak - (carefully) derived from the key before applying the block cipher. This ensures that the final block is treated differently from the other blocks, which in turn means that the adversary no longer has an oracle for evaluating the block cipher at values of his choice.
To make CMAC work for messages that do not consist of a whole number of blocks, CMAC (carefully) derives a second secret value. CMAC first pads the message so that it contains a whole number of blocks, then the second secret is xored with the final (padded) block before the block cipher is applied.
This extra complication could be avoided by always padding the message, but by not doing that, CMAC saves a block cipher evaluation for a significant fraction of all possible messages.
The secret values are derived by applying the block cipher to the all-zero block and then shifting the bit values (sometimes xoring bits into the low-order bits to get a finite field multiplication).
