Can leakage of a plaintext and corresponding aes-cmac compromise the key?


CMAC is also called OMAC1, which is a message authentication code and was recommended by the NIST in 2005.

The security definition of a MAC (wiki link) states, that a MAC must resist existential forgery under chosen plantext attack. That means, that an attacker must not be able to generate any valid MAC (under a certain key), regardless of how many valid pairs of message and MAC he has, where he can even choose the messages himself.

If the attacker could somehow retrieve the key of such pairs, he could easily forge MACs for any message of his choice. But this would be a contradiction to the claim, that the MAC is secure under EUF-CMA (existential forgery under chosen message attack).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.