2
$\begingroup$

For CCM mode of AES can anyone explain what the difference is between $B_i$'s and $m$? Is the nonce value for $B_i$'s and $A_i$'s the same?

What is $l(a)$ and $L$? What is the minimum value of size of $m$?

Does authentication process use the data of $m$?

$\endgroup$
1
$\begingroup$

The standard definition of CCM is NIST SP800-38C. Not all of the symbols you cited appear in NIST SP800-38C. If you're using a different reference, you'll need to cite it to get a more specific answer.

[C]an anyone explain what the difference is between $B_i$'s and $m$?

The $B_i$ are the blocks of input for CBC-MAC, derived from encoding the nonce, associated data, and payload uniquely into a bit string.

$m$ is the number of 128-bit blocks needed to cover the payload to be encrypted.

Is the nonce value for $B_i$'s and $A_i$'s the same?

The CCM encryption operation takes a nonce $N$, an associated data string $A$, and a payload $P$, and returns an authenticated ciphertext. These inputs are all uniquely encoded into a sequence $B_0, B_1, \ldots, B_r$ of 128-bit blocks for authentication. Thus, the nonce $N$ is used to compute some of the $B_i$ blocks, and the associated data string $A$ is used to compute some of the other $B_i$ blocks.

The symbol $A_i$ does not appear in NIST SP800-38C.

What is $l(a)$ and $L$?

These symbols $l(a)$ and $L$ don't appear in NIST SP800-38C.

What is the minimum value of size of $m$?

The minimum value of $m$, the number of 128-bit blocks needed to cover the payload $P$, is zero: the payload may be empty, in which case CCM reduces to a message authentication code.

Does authentication process use the data of $m$?

$m$ is a number of blocks. CCM does authenticate the nonce $N$, the associated data $A$, and the payload $P$. Without knowledge of the secret key, changing the lengths of any of these strings will, with high probability, cause the recipient to reject a message as a forgery.


Details. For a 128-bit block cipher $E_K$, the inputs to CCM are:

  • a key $K$,
  • an octet string $N$ of between 7 and 13 octets inclusive, the nonce;
  • an octet string $A$ of any length, the associated data; and
  • an octet string $P$ of any length, the payload.

The authentication tag in CCM is computed first by encoding the tuple $(N, A, P)$ as a sequence of 128-bit blocks $B_0, B_1, B_2, \ldots, B_r$, as described in §A.2, pp. 12–14; then by computing $Y_0 = E_K(B_0)$, $Y_1 = E_K(B_1 \oplus Y_0)$, $Y_2 = E_K(B_2 \oplus Y_1)$, etc., setting $T = Y_r$, and revealing $$T \oplus E_K(N \mathbin\Vert 0).$$ $T$ is effectively the CBC-MAC tag for the string $B_0 \mathbin\Vert B_1 \mathbin\Vert B_2 \mathbin\Vert \cdots \mathbin\Vert B_r$. Since CBC-MAC on variable-length messages is not itself a secure MAC, the actual authentication tag in CCM is the CBC-MAC tag $T$ concealed by the single-block one-time pad $E_K(N \mathbin\Vert 0)$.

The ciphertext is computed by adding to the payload $P$ the first $|P|$ bits of the one-time pad $$E_K(N \mathbin\Vert 1) \mathbin\Vert E_K(N \mathbin\Vert 2) \mathbin\Vert \cdots \mathbin\Vert E_K(N \mathbin\Vert m)$$ generated by the block cipher $E_K$ in CTR mode, where $|P|$ is the number of bits in $P$ (written $\mathit{Plen}$ in the standard) and $m = \lceil|P|/128\rceil$ is the number of 128-bit blocks needed to cover the length of the payload $P$.

$\endgroup$
  • 1
    $\begingroup$ Although this is technically very likely correct, I'm sure you'd get a better score if you offer a more direct answer to the questions, e.g. by quoting them and then handling the question at hand. This, to me, is not easier to read than the actual standard. Note: didn't downvote. $\endgroup$ – Maarten Bodewes May 8 '18 at 0:29
  • $\begingroup$ @MaartenBodewes Better? $\endgroup$ – Squeamish Ossifrage May 8 '18 at 0:52
  • 1
    $\begingroup$ Yes, but "and the associated data string $A$ is used to compute the some of the $B_i$ blocks." probably contains a spelling mistake. Minor nitpick though. $\endgroup$ – Maarten Bodewes May 8 '18 at 1:16
  • $\begingroup$ @SqueamishOssifrage Given the symbols the OP quotes, I'm assuming the reference is RFC 3610 $\endgroup$ – hakoja May 8 '18 at 15:58
  • $\begingroup$ @hakoja Sounds plausible. Maybe I will update to reflect that when I have a spare moment. $\endgroup$ – Squeamish Ossifrage May 8 '18 at 16:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.