Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cmac]

CMAC is a block cipher-based message authentication code algorithm.

3
votes
2answers
147 views

Any point using CMAC with AES-256?

As we know, AES-256 is a block cipher with 256-bit key and 128-bit block size. The CMAC message authentication code outputs tag length equal to block cipher block size - thus 128 bits with AES. And ...
0
votes
1answer
93 views

Cipher based message authentication (CMAC) and block reordering

Is Cipher based message authentication (CMAC) susceptible to block reordering (just like CBC)?
3
votes
1answer
82 views

MAC size: Should MAC be shorter than cipher block size?

Many sources claim that (if possible) a length of MAC should be as long as possible. So it should have the same size as size of the block of used cipher. However there is the following note in Bouncy ...
0
votes
1answer
244 views

CMAC Generation : If input payload length is not aligned in 16 bytes, what are the possible side effects?

While searching for answers ,I understand that RFC AES-CMAC 4493 is suggested by NIST to overcome if payload is not aligned in 16 bytes. I would like to know what drawbacks/insecure caused by AES-...
1
vote
0answers
121 views

Is it safe to re-use the salt for HKDF as a challenge for proof of possession after key derivation?

I have a system made of 2 or more parties, already sharing a master key MK, who want to agree on a session key SK (both 128-bit ...
2
votes
0answers
159 views

AES-CTR and AES-CMAC using the same temporary key

Is it a severe security issue using a short-lived dynamic key for both AES-CTR and AES-CMAC? CMAC is generated on the cleartext and 32 bit of it are attached to the message (MAC-and-Encrypt) The key ...
0
votes
2answers
53 views

How to combine AES-CMACs

I have a primitive that is able to generate a AES-128-CMAC from a message. $\operatorname{CMAC}(\text{MessageAddress}, \text{MessageLength}) \rightarrow \text{result}$ I cannot change this primitive....
0
votes
1answer
214 views

CBC-MAC for Arbitrary Length Messages

Katz/Lindell propose the following modification to the basic CBC-MAC scheme to handle variable length messages (p.125): We sample two uniform independent keys $k_1, k_2\in \{0,1\}^n$. Then to ...
3
votes
1answer
228 views

Is this MAC-then-encrypt scheme secure?

I have the following requirements: 64 bits (8 bytes) of data ($D$) that requires confidentiality and integrity; the data itself is a nonce, never need to authenticate/encrypt the same value twice (e....
4
votes
0answers
184 views

Is CMAC vulnerable to length extension attacks?

Given $m_1, m_2$ such that $MAC_k(m_1) = MAC_k(m_2)$ is it possible to construct more collisions with pairs of the form $m_1|x, m_2|x$? Here is the CMAC picture from Wikipedia where it is only part ...
4
votes
1answer
235 views

Should AES-CMAC key cryptoperiod be affected by MAC truncation to avoid birthday-attacks?

Given a 128-bit key used for authentication based on AES-CMAC, the NIST 800-38B recommendations suggest at least two criteria for a good key cryptoperiod: after 'MaxInvalids' error messages the key ...
3
votes
2answers
382 views

Using only 4 Bytes of AES-CMAC

if i calculate a AES_CMAC for 64 Bytes, i get a 16 Byte CMAC. Is it ok to use only the first 4 Bytes for authentication? Can i assume that if the first 4 bytes are correct, the other bytes must be ...
-1
votes
1answer
60 views

Key extraction from Plaintext+CMAC

Can leakage of a plaintext and corresponding aes-cmac compromise the key?
2
votes
1answer
447 views

AES vs AES-CMAC for session key derivation

Assume two parties have exchanged a secret 128-bit Master Key, MK. When the two parties want to communicate, one of them generates a random 128-bit value, R, which is then sent in plaintext to the ...
5
votes
2answers
673 views

Can CMAC be used as a 128bit Key Derivation Function?

I want to derive a key a number of times for a deterministic scenario, where I can get n keys from a single one. The logic looks something like this: ...
8
votes
1answer
438 views

Side channel security of HMAC in software

Assume we have a processor with a symmetric co-processor that supports AES. This processor does however not provide co-processor support for hash algorithms such as SHA-1 or SHA-256. I've got the ...
4
votes
1answer
13k views

Difference between AES CMAC and AES HMAC?

Can someone elaborate on how 'signing' is done using AES- CMAC and AES-HMAC? HMAC Signing as I understand: Compute the HMAC( Hash the key and the input concatenated in a special way) Verification: ...
2
votes
1answer
1k views

CMAC for messages shorter than 128bit

RFC4493 describes the generation of AES-CMAC and padding for messages with length > sizeof(aes128_key). However I need to generate the CMAC for a series of messages shorter than 16 byte. So I'd like ...
3
votes
0answers
92 views

Unknown authenticated encryption mode

I'm running through a protocol specification (LoRaWAN, pdf), and I'm puzzled by the crypto. The data is encrypted and authenticated in the following way: a unique 128-bit key is used; the plaintext ...
2
votes
1answer
237 views

Subkey generation in OMAC1/CMAC with XTEA?

All implementations of CMAC that I have found so far use a block cipher with the same key and block size. However, XTEA enciphers a 64 bit block by using a 128 bit key. If ...
7
votes
2answers
824 views

What are the implications of a birthday attack on a HMAC?

After collecting approximately $2^{n/2}$ message-tag pairs a collision can be observed. So two different messages (m1 and m2) will have the same tag. This paper states: Then, for any string x, (...
1
vote
0answers
115 views

Why does OMAC2 exist?

The specification for OMAC has the following to say about OMAC2: For OMAC2, we adopted u−1 instead of u2 as Cst2. It requires one right shift to compute L· u−1 instead of one left shift to compute (L·...
2
votes
2answers
492 views

Is there any advantage on encrypting the CMAC together with the message?

I'm reading a protocol specification where the procedure is to generate a CMAC, take the first 4 bytes of it, append this authentication tag to the message and then encrypt the message + CMAC together ...
1
vote
1answer
116 views

Is AES_CMAC specified to double ciphered zeroes during initialization?

Reading the SIV RFC https://tools.ietf.org/html/rfc5297#page-9, I found that the S2V function starts by calculating the MAC of a "zero" block, doubles it and then XORs further data to the result. Now ...
2
votes
1answer
928 views

Is it safe to AES-CBC and AES-CMAC both using the same key?

There is a very similar question (Using a derived key for CMAC) but it doesn't quite answer this one (at least for me it does not). I have a situation where I need to transfer some data. My data has ...
1
vote
1answer
950 views

EAX: OMAC and CMAC

OMAC is specified as the underlying algorithm to provide authentication within the EAX authenticated encryption (with associated data). Would that be OMAC1 or OMAC2? If it is OMAC1, does that mean it ...
3
votes
1answer
2k views

CMAC vs HMAC security strength

From the perspective of a Birthday Paradox attack, isn't it true that CMAC based on AES-128 is weaker than HMAC-SHA-1? The attack on CMAC-AES-128 requires about $2^{64}$ operations whereas the same ...
2
votes
1answer
90 views

Should I calculate two CMACs over two different strings that share common bytes?

I am trying to secure my RF communication in which one RF package consists of two separate segments. I need to make sure that one segment of one packet is not replaced with a valid segment of some ...
2
votes
0answers
180 views

Where is the OID and ASN.1 specified for AES_CMAC?

I have a requirement to implement AES_CMAC as the authentication algorithm in a CMS library. I just can't seem to find the OID and the ASN.1 definition for it. I expected to see the OID under {joint-...
15
votes
1answer
10k views

Use cases for CMAC vs. HMAC?

Both can be used to verify the integrity of a message. Assuming you have the needed primitives available to you (i.e. the code space of needing both a cipher and a hash function isn't prohibitive), is ...
10
votes
1answer
5k views

Difference between CBC-MAC and CMAC

According to Wikipedia, CMAC is based on a variation of CBC-MAC and fixes some security deficiencies in it. However, I could not find a simple and clear explanation of what the differences between ...
3
votes
1answer
179 views

OMAC : Padding on empty string

I started to implement some MAC since last week with the specifications given here. I'm currently testing the OMAC (one-key CBC) with test vectors. In the OMAC specifications at page 4, they explain ...