One-key MAC

"CMAC" redirects here. For other uses, see CMAC (disambiguation).

One-key MAC (OMAC) is a family of message authentication codes constructed from a block cipher much like the CBC-MAC algorithm. It may be used to provide assurance of the authenticity and, hence, the integrity of data. Two versions are defined:

• The original OMAC of February 2003, which is seldom used.^[1] The preferred name is now "OMAC2".^[2]
• The OMAC1 refinement,^[2] which became an NIST recommendation in May 2005 under the name CMAC.^[3]

OMAC is free for all uses: it is not covered by any patents.^[4]

History

The core of the CMAC algorithm is a variation of CBC-MAC that Black and Rogaway proposed and analyzed under the name "XCBC"^[5] and submitted to NIST.^[6] The XCBC algorithm efficiently addresses the security deficiencies of CBC-MAC, but requires three keys.

Iwata and Kurosawa proposed an improvement of XCBC that requires less key material (just one key) and named the resulting algorithm One-Key CBC-MAC (OMAC) in their papers.^[1] They later submitted the OMAC1 (= CMAC),^[2] a refinement of OMAC, and additional security analysis.^[7]

Algorithm

To generate an ℓ-bit CMAC tag (t) of a message (m) using a b-bit block cipher (E) and a secret key (k), one first generates two b-bit sub-keys (k₁ and k₂) using the following algorithm (this is equivalent to multiplication by x and x² in a finite field GF(2^b)). Let ≪ denote the standard left-shift operator and ⊕ denote bit-wise exclusive or:

1. Calculate a temporary value k₀ = E_k(0).
2. If msb(k₀) = 0, then k₁ = k₀ ≪ 1, else k₁ = (k₀ ≪ 1) ⊕ C; where C is a certain constant that depends only on b. (Specifically, C is the non-leading coefficients of the lexicographically first irreducible degree-b binary polynomial with the minimal number of ones: 0x1B for 64-bit, 0x87 for 128-bit, and 0x425 for 256-bit blocks.)
3. If msb(k₁) = 0, then k₂ = k₁ ≪ 1, else k₂ = (k₁ ≪ 1) ⊕ C.
4. Return keys (k₁, k₂) for the MAC generation process.

As a small example, suppose b = 4, C = 0011₂, and k₀ = E_k(0) = 0101₂. Then k₁ = 1010₂ and k₂ = 0100 ⊕ 0011 = 0111₂.

The CMAC tag generation process is as follows:

1. Divide message into b-bit blocks m = m₁ ∥ ... ∥ m_n−1 ∥ m_n, where m₁, ..., m_n−1 are complete blocks. (The empty message is treated as one incomplete block.)
2. If m_n is a complete block then m_n′ = k₁ ⊕ m_n else m_n′ = k₂ ⊕ (m_n ∥ 10...0₂).
3. Let c₀ = 00...0₂.
4. For i = 1, ..., n − 1, calculate c_i = E_k(c_i−1 ⊕ m_i).
5. c_n = E_k(c_n−1 ⊕ m_n′)
6. Output t = msb_ℓ(c_n).

The verification process is as follows:

1. Use the above algorithm to generate the tag.
2. Check that the generated tag is equal to the received tag.

Variants

CMAC-C1^[8] is a variant of CMAC that provides additional commitment and context-discovery security guarantees.

Implementations

• Python implementation: see the usage of the AES_CMAC() function in "impacket/blob/master/tests/misc/test_crypto.py", and its definition in "impacket/blob/master/impacket/crypto.py"^[9]
• Ruby implementation^[10]

References

1. Iwata, Tetsu; Kurosawa, Kaoru (2003-02-24). "OMAC: One-Key CBC MAC". Fast Software Encryption. Lecture Notes in Computer Science. Vol. 2887. Springer, Berlin, Heidelberg. pp. 129–153. doi:10.1007/978-3-540-39887-5_11. ISBN 978-3-540-20449-7.
2. Iwata, Tetsu; Kurosawa, Kaoru (2003). "OMAC: One-Key CBC MAC – Addendum" (PDF). In this note, we propose OMAC1, a new choice of the parameters of OMAC-family (see [4] for the details). Test vectors are also presented. Accordingly, we rename the previous OMAC as OMAC2. (That is to say, test vectors for OMAC2 were already shown in [3].) We use OMAC as a generic name for OMAC1 and OMAC2. {{cite journal}}: Cite journal requires |journal= (help)
3. Dworkin, Morris (2016). "Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication" (PDF). doi:10.6028/nist.sp.800-38b. {{cite journal}}: Cite journal requires |journal= (help)
4. Rogaway, Phillip. "CMAC: Non-licensing". Retrieved May 27, 2020. Phillip Rogaway's statement on intellectual property status of CMAC
5. Black, John; Rogaway, Phillip (2000-08-20). Advances in Cryptology – CRYPTO 2000. Springer, Berlin, Heidelberg. pp. 197–215. doi:10.1007/3-540-44598-6_12. ISBN 978-3540445982.
6. Black, J; Rogaway, P. "A Suggestion for Handling Arbitrary-Length Messages with the CBC MAC" (PDF). {{cite journal}}: Cite journal requires |journal= (help)
7. Iwata, Tetsu; Kurosawa, Kaoru (2003-12-08). "Stronger Security Bounds for OMAC, TMAC, and XCBC". In Johansson, Thomas; Maitra, Subhamoy (eds.). Progress in Cryptology - INDOCRYPT 2003. Lecture Notes in Computer Science. Vol. 2904. Springer Berlin Heidelberg. pp. 402–415. CiteSeerX 10.1.1.13.8229. doi:10.1007/978-3-540-24582-7_30. ISBN 9783540206095.
8. Bhaumik, Ritam; Chakraborty, Bishwajit; Choi, Wonseok; Dutta, Avijit; Govinden, Jérôme; Shen, Yaobin (2024). "The Committing Security of MACs with Applications to Generic Composition". In Reyzin, Leonid; Stebila, Douglas (eds.). Advances in Cryptology – CRYPTO 2024. Lecture Notes in Computer Science. Vol. 14923. Cham: Springer Nature Switzerland. pp. 425–462. doi:10.1007/978-3-031-68385-5_14. ISBN 978-3-031-68385-5.
9. "Impacket is a collection of Python classes for working with network protocols.: SecureAuthCorp/impacket". 15 December 2018 – via GitHub.
10. "Ruby C extension for the AES-CMAC keyed hash function (RFC 4493): louismullie/cmac-rb". 4 May 2016 – via GitHub.

External links

• RFC 4493 The AES-CMAC Algorithm
• RFC 4494 The AES-CMAC-96 Algorithm and Its Use with IPsec
• RFC 4615 The Advanced Encryption Standard-Cipher-based Message Authentication Code-Pseudo-Random Function-128 (AES-CMAC-PRF-128)
• OMAC Online Test
• More information on OMAC
• Rust implementation