# Subkey generation in OMAC1/CMAC with XTEA?

All implementations of CMAC that I have found so far use a block cipher with the same key and block size. However, XTEA enciphers a 64 bit block by using a 128 bit key. If E_XTEA(key,block) is the encipher function and k is my main key, CMAC produces a temporary key k0 from an all-zero block:

k0 = E_XTEA(k,0)


CMAC derives two other keys from k0 with the same length as k0, k1 and k2. This derivation uses a constant C which is "completely determined by the number of bits in a block"

There are two problems:

• k is 128 bit long, but k0,k1 and k2 are only 64 bit long because they depend on the output of the 64 bit encipher function.
• Is C really determined by the block size instead of the key size?

My assumption is that E_XTEA(k,0) is used to generate a pseudo-random block, and I can use k0 = concat(E_XTEA(k,0),E_XTEA(k,1)) to generate a pseudo-random block of the right size. But I don't know if this is correct or which C to choose.

Look at how the keys $K_1$ and $K_2$ are used in CMAC (pdf, Section 6.2):
1. If $M_n^*$ is a complete block, let $M_n = K_1 \oplus M_n^*$; else, let $M_n = K_2 \oplus (M_n^*||10^j)$, where $j = nb-Mlen-1$.
Similarly, then, $C$ is determined by the block size.
• Thanks, you are completely right. k1 ork2 is only used for a xor operations and is not the key for the cipher function. Sep 16, 2015 at 13:24