I'm trying to use DTLS in Preshared key mode for CoAP which necessitates using CipherSuite TLS_PSK_WITH_AES_128_CCM_8

I'm trying to start with the CBC-MAC but I'm not sure how to get an 8 octet ICV out of it?

Do I just truncate the output and only use the first 8 octets?

Do I use an 8 octet block size instead of the 16 imposed by the CBC function I'm using for hardware acceleration?

const unsigned char k[16] ="lbsHgUDHKgeinLfU";//key 128bits                


const unsigned char message[16] = "Hello world!  ";//multiple of 16 bytes as required
unsigned int mLen = sizeof(message);//16

unsigned char zeroInit[16]= {0};


//CBC-MAC with 8byte ICV
//uint8_t mac[8];//8 octet ICV (hopefully)
uint8_t mac[16];

esp_aes_crypt_cbc( &c,ESP_AES_ENCRYPT,mLen,zeroInit, message, mac);

and the output I get is: ad ea 26 07 25 bb 43 8a 85 b5 ec ca 6c b6 b5 d3

The only difference I see with an array size of 8 is that I only see the first 8 bytes.

up vote 2 down vote accepted

In general the authentication tag size is indeed generated by simply using the first (leftmost, in most byte array representation) bits. In general Tlen - the length of the tag - is supposed to be a multiple of eight, so a tag size of 64 bits results in the leftmost 8 bytes.

You cannot just change the block size of a block cipher. AES is only supporting a 128 bit / 16 byte block size (although Rijndael supports any block size between 128 and 256 bits inclusive using 32 bit increments). So changing the block size of a cipher is generally out of the question.


The usage of just the first/leftmost bytes out of the full MAC output is so widespread that an AEAD API interface that I wrote based the method signatures on the fact. Note that the output of a MAC is indistinguishable from random anyway, so in principle you can use any bits of the result; using the first/leftmost bytes is however the commonly agreed default.


If unsure: read the standard, NIST SP-800 38C:

Set $T=\operatorname{MSB}_{Tlen}(Y_r)$

and

$\operatorname{MSB}_s(X)$ : The bit string consisting of the $s$ left-most bits of the bit string $X$.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.