OMAC is specified as the underlying algorithm to provide authentication within the EAX authenticated encryption (with associated data). Would that be OMAC1 or OMAC2?

If it is OMAC1, does that mean it is identical to AES-CMAC if EAX mode uses the AES block cipher as primitive?


1 Answer 1


Wrapping my (now deleted) comments into an answer…

OMAC, as described in the OMAC spec and its addendum, is what Rogaway et al provide security proofs for in their EAX paper. If you take a quick look at RFC 4493, you’ll notice that it states:

The National Institute of Standards and Technology (NIST) has recently specified the Cipher-based Message Authentication Code (CMAC), which is equivalent to the One-Key CBC MAC1 (OMAC1) submitted by Iwata and Kurosawa.

This already provides a good hint. But let’s see what Iwata's web page has to say about it. He should definitely know since he created that thing:

OMAC is a blockcipher-based message authentication code designed and analyzed by me and Kaoru Kurosawa.

OMAC is a simple variant of the CBC MAC (Cipher Block Chaining Message Authentication Code). OMAC stands for One-Key CBC MAC.

OMAC allows and is secure for messages of any bit length (while the CBC MAC is only secure on messages of one fixed length, and the length must be a multiple of the block length). Also, the efficiency of OMAC is highly optimized. It is almost as efficient as the CBC MAC.

``NIST Special Publication 800-38B Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication'' has been finalized on May 18, 2005. This Recommendation specifies CMAC, which is equivalent to OMAC (OMAC1).

OMAC: Brief description

OMAC is a generic name for OMAC1 and OMAC2. OMAC1 is described first. OMAC1 is equivalnent to CMAC.

(italic-bold emphasis mine, but that typo is Iwata’s… I didn’t correct it since I wanted to quote things correctly and unmodified.)

So, to answer your questions based on the above:

  1. OMAC points to OMAC1.
  2. Yes, OMAC1 is identical to AES-CMAC…

In case of doubt, simply read the relevant information in NIST SP800-38B, page 2:

Iwata and Kurosawa proposed an improvement of XCBC and named the resulting algorithm One-Key CBC-MAC (OMAC) in Ref. [6] and in Ref. [5], their initial submission to NIST; they later submitted OMAC1 [7], a refinement of OMAC, and additional security analysis [8]. The OMAC1 variation efficiently reduces the key size of XCBC. CMAC is equivalent to OMAC1.

Because CMAC is based on an approved symmetric key block cipher, such as the Advanced Encryption Standard (AES) algorithm that is specified in Federal Information Processing Standard (FIPS) Pub. 197 [3], CMAC can be considered a mode of operation of the block cipher.

(italic-bold emphasis mine)

  • 1
    $\begingroup$ It's always hard to argue against quotes straight from the source(s)... thanks. $\endgroup$
    – Maarten Bodewes
    Aug 26, 2014 at 17:47
  • $\begingroup$ Note that, in above quotations, OMAC itself seems to be a generic term for OMAC1 and OMAC2 according to Iwata and a refinement of OMAC according to NIST. I'll just call it CMAC from now on. $\endgroup$
    – Maarten Bodewes
    Aug 26, 2014 at 18:26
  • $\begingroup$ @owlstead Makes sense. Guess I’ll join and do the same from now on. $\endgroup$
    – e-sushi
    Aug 26, 2014 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.