# Difference between CBC-MAC and CMAC

According to Wikipedia, CMAC is based on a variation of CBC-MAC and fixes some security deficiencies in it. However, I could not find a simple and clear explanation of what the differences between the two algorithms actually are, so I thought I'd ask here:

How does CMAC differ from CBC-MAC, and why?

• – user991
Commented Jan 12, 2014 at 1:00
• As Ricky notes, wikipedia already tries to solve your problem. Perhaps (as a sign of prior research and to help future readers) you could update your question clarifying why this is not sufficient? Commented Jan 12, 2014 at 2:36
• @figlesquidge: While the information requested probably is obtainable from Wikipedia, it's not very clearly presented there. IMO, this is a perfectly good reference question, and I'm hoping to see a concise and comprehensive answer summarizing the main differences. Commented Jan 12, 2014 at 6:46
• @IlmariKaronen : that is exactly what I am looking for. Actually, I also didn't found any good visual representation of the CMAC algorithm compared with the CBC-MAC. Also, Wikipedia is not always the best in describing cryptography concepts. Commented Jan 12, 2014 at 10:05
• Sorry, perhaps I should have written "where this is not clear" or similar rather than 'sufficient'. Commented Jan 12, 2014 at 13:10

The problem with CBC-MAC for variable-length messages is that CBC-MAC applied to a one-block message essentially amounts to an oracle for evaluating the block cipher at values of the adversary's choice. And that oracle allows an adversary to break the scheme.

Consider first CMAC restricted to messages that consist of a whole number of blocks. Then the difference between CMAC and CBC-MAC is that CMAC xors the final block with a secret value - you could call it a tweak - (carefully) derived from the key before applying the block cipher. This ensures that the final block is treated differently from the other blocks, which in turn means that the adversary no longer has an oracle for evaluating the block cipher at values of his choice.

To make CMAC work for messages that do not consist of a whole number of blocks, CMAC (carefully) derives a second secret value. CMAC first pads the message so that it contains a whole number of blocks, then the second secret is xored with the final (padded) block before the block cipher is applied.

This extra complication could be avoided by always padding the message, but by not doing that, CMAC saves a block cipher evaluation for a significant fraction of all possible messages.

The secret values are derived by applying the block cipher to the all-zero block and then shifting the bit values (sometimes xoring bits into the low-order bits to get a finite field multiplication).