As we know, AES-256 is a block cipher with 256-bit key and 128-bit block size.

The CMAC message authentication code outputs tag length equal to block cipher block size - thus 128 bits with AES. And this provides an assurence that only 1 in 2^128 attempts in forgery may possibly succeed.

So is there any point using a 256-bit key as may be the case with AES-256?

  • $\begingroup$ If you use AES-128 an attacker may find (in theory) brute-forcing the 128-bit key to be easier than trying the random forging approach, especially if it's a protocol like TLS that rekeys after a single MAC fail. $\endgroup$ – SEJPM Dec 22 '18 at 15:05

Brute forcing ciphertext an offline attack, while attacking the authentication tag (the result of the CMAC-calculation) is an online attack: it requires an active oracle. That is: you can try and break the confidentiality of a message on your own PC network of computers. However, you need to send many ciphertext (including authentication tag) to a receiver to see if a guessed tag is correct or not and an invalid ciphertext is accepted (to test if a message is successfully forged). Generally you only get one oracle, and the speed of this oracle is usually limited (e.g. by networking speeds).

If an authentication tag is not accepted then that doesn't give any information to an attacker if the next message changes. This would for instance be the case if a unique sequence number is included in the messages (although usually the authentication tag is verified earlier, so oracle attacks would be possible). Furthermore, many protocols will break a session and re-establish the session keys if an incorrect authentication tag is received.

In conclusion: attacking an authentication tag is much harder than breaking a cipher, even if the order of the attack is the same. Because of this it makes sense to increase the key size even if the tag size stays the same.

If you need more than 128 bits of security is of course another question; 128 bits seems plenty as long as quantum computers are not available. 256 bit encryption should be considered for messages that require long-term protection.


From rfc4493 (The AES-CMAC Algorithm);

The security provided by AES-CMAC is built on the strong cryptographic algorithm AES. However, as is true with any cryptographic algorithm, part of its strength lies in the secret key, K, and the correctness of the implementation in all of the participating systems.

As the standard states; the longer key the harder to forgery. However, the standard is not mentioning about using the AES with 256-bit key.

Your suggestion to increase the key size to 256-bit will definitely make the brute-force infeasible for a long time.

To forge a message by trying every tag is measured by the tag space, in this case, the attacker needs to attack $128$-bit and this is always same for AES.

  • $\begingroup$ I'm finding your answer here a bit hard to follow. In particular, in the last paragraph you write about "the case of the brute force", even though both trying all $2^{256}$ keys and trying all $2^{128}$ tags would generally be considered brute force attacks. $\endgroup$ – Ilmari Karonen Dec 22 '18 at 19:46
  • $\begingroup$ @IlmariKaronen clear now? $\endgroup$ – kelalaka Dec 22 '18 at 20:05

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.