All implementations of CMAC that I have found so far use a block cipher with the same key and block size. However, XTEA enciphers a 64 bit block by using a 128 bit key. If E_XTEA(key,block) is the encipher function and k is my main key, CMAC produces a temporary key k0 from an all-zero block:

k0 = E_XTEA(k,0)

CMAC derives two other keys from k0 with the same length as k0, k1 and k2. This derivation uses a constant C which is "completely determined by the number of bits in a block"

There are two problems:

  • k is 128 bit long, but k0,k1 and k2 are only 64 bit long because they depend on the output of the 64 bit encipher function.
  • Is C really determined by the block size instead of the key size?

My assumption is that E_XTEA(k,0) is used to generate a pseudo-random block, and I can use k0 = concat(E_XTEA(k,0),E_XTEA(k,1)) to generate a pseudo-random block of the right size. But I don't know if this is correct or which C to choose.


1 Answer 1


Look at how the keys $K_1$ and $K_2$ are used in CMAC (pdf, Section 6.2):

  1. If $M_n^*$ is a complete block, let $M_n = K_1 \oplus M_n^*$; else, let $M_n = K_2 \oplus (M_n^*||10^j)$, where $j = nb-Mlen-1$.

They are combined with message blocks using XOR. So they must be equal in length to the block size, not the key size (if different), of the cipher.

Similarly, then, $C$ is determined by the block size.

  • $\begingroup$ Thanks, you are completely right. k1 ork2 is only used for a xor operations and is not the key for the cipher function. $\endgroup$
    – limond
    Sep 16, 2015 at 13:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.