How does padding in PMAC work? I have been told two stories: Firstly, I have been told that it works similar to CMAC padding, and secondly, I have been told that it does not need padding.

I find the second story very strange as I think one could make an existential forger quite easily. But if PMAC pads like CMAC, then surely we would need another key.

TL;DR I don't know how padding in PMAC works, please can someone explain.


Obviously, PMAC needs a padding because you want to be able to compute MACs of messages which are not multiple of the block length. The padding is defined in the PMAC paper http://www.cs.ucdavis.edu/~rogaway/ocb/pmac.pdf, it simply complete the last block adding a single '1' bit and as many '0' bits as needed.

Note that messages whose length are multiples of the block length are not padded. As a consequence, to preserve security, the treatment of the final block is different for the two types of messages. More precisely, before the final encryption an additional key-dependent value is XORed in. See the above paper for full details.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.