Skip to main content

Questions tagged [cmac]

CMAC is a block cipher-based message authentication code algorithm.

Filter by
Sorted by
Tagged with
1 vote
1 answer
144 views

How to generate 24 bytes CMAC using AES-192 or AES-256

Is it possible to generate a 24 bytes CMAC using AES-192 or AES-256 and if so, how? According to AN10922AN10922.0df,looks like we can generate 24 bytes and 32 bytes key using div constant ?
Rohit Kumar's user avatar
5 votes
1 answer
153 views

Robust CMAC-based key derivation function

I need to select a key derivation function that will likely be used in contexts that I haven't anticipated. It will run on very low-end devices (think potato-powered IoT sensor with a bulk cost of a ...
Gilles 'SO- stop being evil''s user avatar
1 vote
0 answers
185 views

Quantum-Safe MAC: HMAC and CMAC

If understood right, CMAC is not quantum-safe because it relies on AES-128 (which isn't considered as quantum-safe), while HMAC is, because it relies on SHA3 (which is considered as quantum-safe). Did ...
bilaljo's user avatar
  • 163
1 vote
0 answers
70 views

Construction of a SKE scheme based on a PRF family and on a MAC with UF-CMA security. Is the scheme secure?

Consider the following construction of a SKE scheme $\Pi^*=(Enc^*,Dec^*)$ based on a PRF family $F=\{F_k:\{0,1\}^n\rightarrow \{0,1\}^n\}_{k\in\{0,1\}^\lambda}$ and on a MAC $ Tag:\{0,1\}^\lambda \...
Giusy's user avatar
  • 33
1 vote
1 answer
140 views

Is it possible to extend CMAC for ChaCha

CMAC is defined for AES for authentication. My question is pretty simple: is it possible to extend CMAC for ChaCha? Does it even make sense? I cannot find anything related and I am wondering if I am ...
Pol Henarejos's user avatar
2 votes
2 answers
732 views

What AES mode does the CMAC use in Secure Channel Protocol 3 (SCP03)?

I am looking to verify a card cryptogram sent from a smart card chip in accordance with SCP03. According to the SCP03 spec, the CMAC is used to generate a MAC to authenticate messages sent to/from the ...
veda-s4dhak's user avatar
0 votes
2 answers
650 views

Is CMAC secure without IV and the same key? (authenticate only)

I am a bit unsure about CMAC and GMAC and maybe someone can help me. As far as I know, CMAC does not use an IV [SP 800-38B ch. 6.2]. Is it then secure if I use the same key for different messages? ......
SBond's user avatar
  • 103
1 vote
1 answer
364 views

Using CMAC instead of hash function for message signing [duplicate]

Generally, when we want to generate a signature for message M we use hash function H, and sign the result of H(M) with the private key. What if instead of hash function H we would use a CMAC with key ...
morsisko's user avatar
  • 113
1 vote
1 answer
87 views

Why is Masking used in CMAC? [closed]

I am working on masking in CMAC. If masking is not used, then what will be the behavior of CMAC?
harpreet's user avatar
0 votes
1 answer
73 views

Complexity of deriving message from CMAC vs HMAC when the key is known

From the description of CMAC and HMAC, given the key and the tag, I think it is easy to derive the CMAC message than the HMAC message. After obtaining the key and tag for CMAC, an intruder can apply ...
Mohit Kumar Jangid's user avatar
0 votes
1 answer
917 views

How to calculate a hmac and cmac

I'm searching for a simple description that tells me in a schematic way how hmac and cmac is calculated. So far I found the following: ...
MaMa's user avatar
  • 39
1 vote
0 answers
232 views

Forgery of the Carter-Wegman MAC

Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:...
Sayantan's user avatar
10 votes
0 answers
213 views

Do CCM and EAX provide key commitment?

In an interesting paper called "Partitioning Oracle Attacks" by Julia Len, Paul Grubbs & Thomas Ristenpart an attack is presented on 1.5 pass AEAD schemes that utilize GMAC (GCM, AES-GCM,...
Maarten Bodewes's user avatar
  • 93.2k
3 votes
1 answer
352 views

CMAC - how is ambiguity resolved?

To avoid the dummy padding block, CMAC uses 2 separate keys K1 & K2. If padding is required, the final block is padded & then XORed with K1. If no padding is required, then it's XORed with K2. ...
user93353's user avatar
  • 2,245
0 votes
1 answer
269 views

Byte order in AES-CMAC test code

I'm looking at the AES-CMAC RFC and I found somehow counter-intuitive the way test vectors are used in the test code. Let's look at the key K ...
Šatov's user avatar
  • 103
0 votes
0 answers
320 views

CMAC operation on HSM

I have generated an AES key on HSM and I need to calculate the CMAC between this key with an input value. Is it possible to do this on HSM? What is the mechanism to invoke?
Nitin V Kuttan's user avatar
-1 votes
1 answer
107 views

what are the things that aes cbc-mac , aes cmac guarantees?

does aes-cbc-mac guarantees integrity, authenticity and confidentiality? does aes-cmac guarantees integrity, authenticity and confidentiality? because I only know that aes-ccm guarantees all i.e. ...
wanglen soram's user avatar
0 votes
1 answer
1k views

blockcipher-based MACs with variable length that are UF-CMA secure?

There are may papers and notes explain why CBC-MAC is only UF-CMA secure for fix length messages. Are there any other blockcipher-based (blockcipher and hash combined included) MACs that is UF-CMA ...
securityDummy's user avatar
2 votes
1 answer
1k views

Why should one use a cypher-based message authentication code (CMAC) instead of symmetric encryption and CRC?

What are advantages/disadvantages for using a CMAC that proofs the integrity and authenticity of a message but doesn't encrypt the payload itself? Why should it be used instead of symmetric encrypted ...
MaMa's user avatar
  • 39
2 votes
1 answer
493 views

Possible attacks on CMAC

I'm studying possible attacks on CMAC and I've found the NISTSP800-38B document where a list of possible attacks are defined. However I have some doubts on possible attacks using forged messages. For ...
FabioLovi's user avatar
2 votes
2 answers
379 views

Parallelizing MACs by subdividing the message and then aggregating results

Most MACs other than GMAC (and Poly1305?) are not parallelizable. Examples include CMAC and HMAC. Could these be securely parallelized by computing multiple MACs in parallel and then combining the ...
Adam Ierymenko's user avatar
4 votes
1 answer
2k views

AES - CCM, why not use CMAC inside instead of CBC-MAC?

I was reading up on AES-CMAC when I learned that this basically is an improved and more robust version of CBC-MAC, with the ability to safely have variable-length messages. Difference between CBC-...
Martin Aa S's user avatar
1 vote
1 answer
951 views

What Are Secure Limits to Truncate the Authentication Tag (Mac) for Short Messages?

I have messages with the following fixed lengths: 4 byte 8 byte 16 byte I want to encrypted them and prevent modification by appending an authentication tag using a MAC algorithm of my choosing (e.g....
Patrick's user avatar
  • 251
1 vote
0 answers
141 views

How to implement correctly a "secure" authentication protocol? [closed]

Due to my lack of knowledge in this matter I am facing some problems to identify which features are sign of a bad implementation of a symmetric authorization application. As I am concerned the system ...
user67441's user avatar
1 vote
1 answer
975 views

AES, CMAC and "3 pass authentication protocol" Explained

I am struggling a bit to understand how authentication systems are properly used in NFC tag environments so I'm posting this thread to clarify some concepts.(In advance, this is not my field, so ...
user67411's user avatar
4 votes
2 answers
4k views

Any point using CMAC with AES-256?

As we know, AES-256 is a block cipher with 256-bit key and 128-bit block size. The CMAC message authentication code outputs tag length equal to block cipher block size - thus 128 bits with AES. And ...
DannyNiu's user avatar
  • 9,436
0 votes
1 answer
285 views

Cipher based message authentication (CMAC) and block reordering

Is Cipher based message authentication (CMAC) susceptible to block reordering (just like CBC)?
user2896215's user avatar
3 votes
1 answer
455 views

MAC size: Should MAC be shorter than cipher block size?

Many sources claim that (if possible) a length of MAC should be as long as possible. So it should have the same size as size of the block of used cipher. However there is the following note in Bouncy ...
Quark's user avatar
  • 173
0 votes
1 answer
2k views

CMAC Generation : If input payload length is not aligned in 16 bytes, what are the possible side effects?

While searching for answers ,I understand that RFC AES-CMAC 4493 is suggested by NIST to overcome if payload is not aligned in 16 bytes. I would like to know what drawbacks/insecure caused by AES-...
danny's user avatar
  • 253
1 vote
0 answers
248 views

Is it safe to re-use the salt for HKDF as a challenge for proof of possession after key derivation?

I have a system made of 2 or more parties, already sharing a master key MK, who want to agree on a session key SK (both 128-bit ...
gentooise's user avatar
  • 254
2 votes
0 answers
395 views

AES-CTR and AES-CMAC using the same temporary key

Is it a severe security issue using a short-lived dynamic key for both AES-CTR and AES-CMAC? CMAC is generated on the cleartext and 32 bit of it are attached to the message (MAC-and-Encrypt) The key ...
broth-itk's user avatar
0 votes
2 answers
152 views

How to combine AES-CMACs

I have a primitive that is able to generate a AES-128-CMAC from a message. $\operatorname{CMAC}(\text{MessageAddress}, \text{MessageLength}) \rightarrow \text{result}$ I cannot change this primitive....
Cilyan's user avatar
  • 103
0 votes
1 answer
1k views

CBC-MAC for Arbitrary Length Messages

Katz/Lindell propose the following modification to the basic CBC-MAC scheme to handle variable length messages (p.125): We sample two uniform independent keys $k_1, k_2\in \{0,1\}^n$. Then to ...
CRYPTONEWBIE's user avatar
3 votes
1 answer
713 views

Is this MAC-then-encrypt scheme secure?

I have the following requirements: 64 bits (8 bytes) of data ($D$) that requires confidentiality and integrity; the data itself is a nonce, never need to authenticate/encrypt the same value twice (e....
gentooise's user avatar
  • 254
4 votes
1 answer
788 views

Is CMAC vulnerable to length extension attacks?

Given $m_1, m_2$ such that $MAC_k(m_1) = MAC_k(m_2)$ is it possible to construct more collisions with pairs of the form $m_1|x, m_2|x$? Here is the CMAC picture from Wikipedia where it is only part ...
Elias's user avatar
  • 4,923
5 votes
1 answer
596 views

Should AES-CMAC key cryptoperiod be affected by MAC truncation to avoid birthday-attacks?

Given a 128-bit key used for authentication based on AES-CMAC, the NIST 800-38B recommendations suggest at least two criteria for a good key cryptoperiod: after 'MaxInvalids' error messages the key ...
gentooise's user avatar
  • 254
3 votes
2 answers
924 views

Using only 4 Bytes of AES-CMAC

if i calculate a AES_CMAC for 64 Bytes, i get a 16 Byte CMAC. Is it ok to use only the first 4 Bytes for authentication? Can i assume that if the first 4 bytes are correct, the other bytes must be ...
Bob's user avatar
  • 71
-1 votes
1 answer
124 views

Key extraction from Plaintext+CMAC

Can leakage of a plaintext and corresponding aes-cmac compromise the key?
dnmx's user avatar
  • 11
2 votes
1 answer
2k views

AES vs AES-CMAC for session key derivation

Assume two parties have exchanged a secret 128-bit Master Key, MK. When the two parties want to communicate, one of them generates a random 128-bit value, R, which is then sent in plaintext to the ...
Bogdan Alexandru's user avatar
6 votes
2 answers
2k views

Can CMAC be used as a 128bit Key Derivation Function?

I want to derive a key a number of times for a deterministic scenario, where I can get n keys from a single one. The logic looks something like this: ...
shewa's user avatar
  • 61
9 votes
1 answer
971 views

Side channel security of HMAC in software

Assume we have a processor with a symmetric co-processor that supports AES. This processor does however not provide co-processor support for hash algorithms such as SHA-1 or SHA-256. I've got the ...
Maarten Bodewes's user avatar
  • 93.2k
6 votes
1 answer
33k views

Difference between AES CMAC and AES HMAC?

Can someone elaborate on how 'signing' is done using AES- CMAC and AES-HMAC? HMAC Signing as I understand: Compute the HMAC( Hash the key and the input concatenated in a special way) Verification: ...
user907810's user avatar
2 votes
1 answer
3k views

CMAC for messages shorter than 128bit

RFC4493 describes the generation of AES-CMAC and padding for messages with length > sizeof(aes128_key). However I need to generate the CMAC for a series of messages shorter than 16 byte. So I'd ...
Philip J. Fry's user avatar
3 votes
0 answers
101 views

Unknown authenticated encryption mode

I'm running through a protocol specification (LoRaWAN, pdf), and I'm puzzled by the crypto. The data is encrypted and authenticated in the following way: a unique 128-bit key is used; the plaintext ...
dots's user avatar
  • 31
2 votes
1 answer
463 views

Subkey generation in OMAC1/CMAC with XTEA?

All implementations of CMAC that I have found so far use a block cipher with the same key and block size. However, XTEA enciphers a 64 bit block by using a 128 bit key. If ...
limond's user avatar
  • 23
7 votes
2 answers
1k views

What are the implications of a birthday attack on a HMAC?

After collecting approximately $2^{n/2}$ message-tag pairs a collision can be observed. So two different messages (m1 and m2) will have the same tag. This paper states: Then, for any string x, (...
Logan's user avatar
  • 161
2 votes
0 answers
224 views

Why does OMAC2 exist?

The specification for OMAC has the following to say about OMAC2: For OMAC2, we adopted u−1 instead of u2 as Cst2. It requires one right shift to compute L· u−1 instead of one left shift to compute (L·...
user24730's user avatar
2 votes
2 answers
1k views

Is there any advantage on encrypting the CMAC together with the message?

I'm reading a protocol specification where the procedure is to generate a CMAC, take the first 4 bytes of it, append this authentication tag to the message and then encrypt the message + CMAC together ...
RubenLaguna's user avatar
1 vote
1 answer
170 views

Is AES_CMAC specified to double ciphered zeroes during initialization?

Reading the SIV RFC https://www.rfc-editor.org/rfc/rfc5297#page-9, I found that the S2V function starts by calculating the MAC of a "zero" block, doubles it and then XORs further data to the ...
Sebastian S's user avatar
2 votes
1 answer
2k views

Is it safe to AES-CBC and AES-CMAC both using the same key?

There is a very similar question (Using a derived key for CMAC) but it doesn't quite answer this one (at least for me it does not). I have a situation where I need to transfer some data. My data has ...
traxonja's user avatar