The NIST Specification Document for CCM Mode of operation 800-38C states on Page 13

The same key, K, is used for both the CTR and CBC-MAC mechanisms within CCM.

is it secure to use same key? or one should prefer two distinct keys. One for CTR Mode and other for CBC-MAC?

Basically you should never reuse a key and neither should you use CBC-MAC. CCM is considered secure because the designer knew about the issues of reusing a key and CBC-MAC length extension issues. The scheme is designed to be secure regardless of these issues.

In a general sense you should always use two keys unless you can prove your scheme to be secure regardless of the fact that the key is reused. The same goes for CBC-MAC, CMAC or HMAC should be preferred instead - CBC-MAC is only secure if the size of the message is known in advance and CCM does take this into consideration.

Also note that if changes are made to your scheme, e.g. supplanting CTR by CBC by another designer/developer then reusing a key may cause your scheme to fail spectacularly. So if you do decide to go this route when creating a secure scheme / protocol then make sure you document it thoroughly.


CCM is a cipher with it's own packet format. This makes it suitable for low level packet encryption / decryption where speed is important. The choice of one key and CBC-MAC was likely inspired by this. For a more generic authenticated cipher mode I'd recommend EAX mode or GCM mode instead.

  • read GCM and liked its feature of authenticating data without doing decryption – RI8S Jun 11 '17 at 10:56

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.