Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
How does padding in PMAC work? I have been told two stories: Firstly, I have been told that it works similar to CMAC padding, and secondly, I have been told that it does not need padding.
I find the second story very strange as I think one could make an existential forger quite easily. But if PMAC pads like CMAC, then surely we would need another key.
TL;DR I don't know how padding in PMAC works, please can someone explain.
Obviously, PMAC needs a padding because you want to be able to compute MACs of messages which are not multiple of the block length. The padding is defined in the PMAC paper http://www.cs.ucdavis.edu/~rogaway/ocb/pmac.pdf, it simply complete the last block adding a single '1' bit and as many '0' bits as needed.
Note that messages whose length are multiples of the block length are not padded. As a consequence, to preserve security, the treatment of the final block is different for the two types of messages. More precisely, before the final encryption an additional key-dependent value is XORed in. See the above paper for full details.
