# AES CCM Mode (CTR with CBC-MAC)

For CCM mode of AES can anyone explain what the difference is between $B_i$'s and $m$? Is the nonce value for $B_i$'s and $A_i$'s the same?

What is $l(a)$ and $L$? What is the minimum value of size of $m$?

Does authentication process use the data of $m$?

The standard definition of CCM is NIST SP800-38C. Not all of the symbols you cited appear in NIST SP800-38C. If you're using a different reference, you'll need to cite it to get a more specific answer.

[C]an anyone explain what the difference is between $B_i$'s and $m$?

The $B_i$ are the blocks of input for CBC-MAC, derived from encoding the nonce, associated data, and payload uniquely into a bit string.

$m$ is the number of 128-bit blocks needed to cover the payload to be encrypted.

Is the nonce value for $B_i$'s and $A_i$'s the same?

The CCM encryption operation takes a nonce $N$, an associated data string $A$, and a payload $P$, and returns an authenticated ciphertext. These inputs are all uniquely encoded into a sequence $B_0, B_1, \ldots, B_r$ of 128-bit blocks for authentication. Thus, the nonce $N$ is used to compute some of the $B_i$ blocks, and the associated data string $A$ is used to compute some of the other $B_i$ blocks.

The symbol $A_i$ does not appear in NIST SP800-38C.

What is $l(a)$ and $L$?

These symbols $l(a)$ and $L$ don't appear in NIST SP800-38C.

What is the minimum value of size of $m$?

The minimum value of $m$, the number of 128-bit blocks needed to cover the payload $P$, is zero: the payload may be empty, in which case CCM reduces to a message authentication code.

Does authentication process use the data of $m$?

$m$ is a number of blocks. CCM does authenticate the nonce $N$, the associated data $A$, and the payload $P$. Without knowledge of the secret key, changing the lengths of any of these strings will, with high probability, cause the recipient to reject a message as a forgery.

Details. For a 128-bit block cipher $E_K$, the inputs to CCM are:

• a key $K$,
• an octet string $N$ of between 7 and 13 octets inclusive, the nonce;
• an octet string $A$ of any length, the associated data; and
• an octet string $P$ of any length, the payload.

The authentication tag in CCM is computed first by encoding the tuple $(N, A, P)$ as a sequence of 128-bit blocks $B_0, B_1, B_2, \ldots, B_r$, as described in §A.2, pp. 12–14; then by computing $Y_0 = E_K(B_0)$, $Y_1 = E_K(B_1 \oplus Y_0)$, $Y_2 = E_K(B_2 \oplus Y_1)$, etc., setting $T = Y_r$, and revealing $$T \oplus E_K(N \mathbin\Vert 0).$$ $T$ is effectively the CBC-MAC tag for the string $B_0 \mathbin\Vert B_1 \mathbin\Vert B_2 \mathbin\Vert \cdots \mathbin\Vert B_r$. Since CBC-MAC on variable-length messages is not itself a secure MAC, the actual authentication tag in CCM is the CBC-MAC tag $T$ concealed by the single-block one-time pad $E_K(N \mathbin\Vert 0)$.

The ciphertext is computed by adding to the payload $P$ the first $|P|$ bits of the one-time pad $$E_K(N \mathbin\Vert 1) \mathbin\Vert E_K(N \mathbin\Vert 2) \mathbin\Vert \cdots \mathbin\Vert E_K(N \mathbin\Vert m)$$ generated by the block cipher $E_K$ in CTR mode, where $|P|$ is the number of bits in $P$ (written $\mathit{Plen}$ in the standard) and $m = \lceil|P|/128\rceil$ is the number of 128-bit blocks needed to cover the length of the payload $P$.

• Although this is technically very likely correct, I'm sure you'd get a better score if you offer a more direct answer to the questions, e.g. by quoting them and then handling the question at hand. This, to me, is not easier to read than the actual standard. Note: didn't downvote. – Maarten Bodewes May 8 '18 at 0:29
• @MaartenBodewes Better? – Squeamish Ossifrage May 8 '18 at 0:52
• Yes, but "and the associated data string $A$ is used to compute the some of the $B_i$ blocks." probably contains a spelling mistake. Minor nitpick though. – Maarten Bodewes May 8 '18 at 1:16
• @SqueamishOssifrage Given the symbols the OP quotes, I'm assuming the reference is RFC 3610 – hakoja May 8 '18 at 15:58
• @hakoja Sounds plausible. Maybe I will update to reflect that when I have a spare moment. – Squeamish Ossifrage May 8 '18 at 16:11