1
$\begingroup$

AESCCM- Couter with Cipher Block Chaining Message.
As it uses cmac for generation for tag , which is internally aes-cbc (block cipher, need block size, may require padding) And Encryption is done with AES-CTR (can be used as stream cipher)

How AES-CCM can behave as a AEAD stream cipher , as it uses aes-cbc ?

Whereas in case of AES-GCM for tag generation uses GMAC and for encryption CTR is used , which are not dependent on block sizes. So this can be used as a stream cipher.

$\endgroup$
  • $\begingroup$ Why are you concerned with whether it is a ‘stream cipher’? $\endgroup$ – Squeamish Ossifrage Oct 16 at 15:53
  • $\begingroup$ @MaartenBodewes, Thank you for the answer, it helped a lot. I needed some time to realize the answer. $\endgroup$ – sourav punoriyar Oct 21 at 7:31
  • $\begingroup$ @souravpunoriyar Well it had an "online mouse" in there. I probably wanted to write "online mode" but I'm still wondering how the mouse sneaked in :) $\endgroup$ – Maarten Bodewes Oct 21 at 14:03
2
$\begingroup$

The property that you are looking for is the "online" property of a stream cipher. CCM was however developed for packet encryption where the size of the data is known beforehand. So CCM lacks the strict online requirements for an online cipher. However, since the cipher underneath still uses counter mode, the encryption itself can still be performed on each byte separately in an online fashion (performing online per bit encryption / decryption is not possible in most implementations).

Usually you'd want to verify the authentication tag for correctness before decryption for any AEAD cipher. That means that the online properties of the underlying counter mode are generally not used. Still, you could first verify and decrypt in online fashion afterwards using two passes over the ciphertext.

Furthermore, if the authentication tag is considered part of the ciphertext - like most libraries do - then it is unlikely that those libraries will expose the online properties of the underlying counter mode during decryption. The implementation will have to cache at least as many bits as present in the authentication tag before it decides that they are part of the counter-mode encrypted plaintext or part of the authentication tag. That means that during decryption the cache is always kept full until the end of the stream is reached.

That the CBC-MAC (not CMAC) used by CCM needs to process the data block by block us usually not considered a problem. Any MAC is required to keep state anyway, and the verification can simply take place when all the data has been processed. Note that GMAC within GCM also performs multiplication over 128 bit blocks. The online property is therefore considered for the cipher part of the AEAD mode only.

Conclusion: CCM has not been defined to offer online encryption / decryption, and there are serious issues with using AEAD ciphers for online encryption / decryption even if it was. That the CBC-MAC construction is used has little to nothing to do with the underlying issues.


I'd you're looking for an AEAD mode with better online properties and MAC based on the block cipher then take a look at EAX. EAX is basically a standardized way of using CTR mode and CMAC authentication.

There are two major drawbacks:

  1. It has only been accepted as draft standard by NIST;
  2. Due to the additional calculations for CMAC compared to CBC-MAC it adds a constant overhead preset message.

And you'd still have all the generic drawbacks mentioned for AEAD ciphers when it comes to online decryption, of course.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.