Question 1

What is CMAC?

Accepted Answer

CMAC (Cipher-based Message Authentication Code, NIST SP 800-38B) is a block cipher-based MAC algorithm that provides data integrity and authenticity verification. It uses block ciphers like AES or Triple DES (TDES) in a sophisticated subkey derivation scheme. CMAC processes data in blocks, generating two subkeys (K1 and K2) from the encryption key, then applying cipher block chaining with specific padding rules. The final block is XORed with K1 (for complete blocks) or K2 (for padded blocks) before final encryption. CMAC provides security equivalent to the underlying block cipher and is widely used in modern cryptographic protocols.

Question 2

Which cipher should I use for CMAC?

Accepted Answer

AES-CMAC is strongly recommended for new applications, providing 128-bit, 192-bit, or 256-bit security depending on key size (AES-128, AES-192, AES-256). AES offers excellent performance on modern hardware with AES-NI acceleration. TDES-CMAC (3DES-CMAC) provides only 112-bit effective security and is significantly slower but may be required for legacy system compatibility or regulatory compliance in financial/payment systems. For new implementations, use AES-256-CMAC for maximum security. AES-128-CMAC offers good balance of security and performance for most applications.

Question 3

What are the CMAC key length requirements?

Accepted Answer

AES-CMAC supports three key lengths: 128 bits (16 bytes/32 hex characters) for AES-128-CMAC, 192 bits (24 bytes/48 hex characters) for AES-192-CMAC, and 256 bits (32 bytes/64 hex characters) for AES-256-CMAC. TDES-CMAC requires either 128 bits (16 bytes/32 hex characters) for 2-key TDES (K1=K3) or 192 bits (24 bytes/48 hex characters) for 3-key TDES (all keys unique). Keys must be generated using cryptographically secure random number generators (CSPRNG). Never derive CMAC keys from passwords without proper key derivation functions (KDF) like PBKDF2 or HKDF. Store keys securely using hardware security modules (HSM) or key management systems.

Question 4

Where is CMAC commonly used?

Accepted Answer

CMAC is widely deployed in modern cryptographic protocols: TLS 1.3 cipher suites for record authentication, IPsec AH (Authentication Header) and ESP (Encapsulating Security Payload) for VPN security, IEEE 802.11i (WPA2/WPA3) for wireless network authentication, NIST key management standards (SP 800-108, SP 800-56C) for key derivation and confirmation, EMV contactless payment cards for offline authentication, ISO/IEC 9797-1 Algorithm 5 for financial message authentication, automotive security (AUTOSAR SecOC) for in-vehicle network protection, Bluetooth LE secure connections for device pairing, and firmware integrity verification in secure boot processes. CMAC is preferred over CBC-MAC because it handles variable-length messages securely without length prepending.

Question 5

Can I truncate CMAC output?

Accepted Answer

Yes, CMAC supports truncation while maintaining security. NIST SP 800-38B recommends minimum MAC lengths: For AES-CMAC, use at least 64 bits (8 bytes) for general security, 96 bits (12 bytes) for strong security applications (AES-CMAC-96 is common in IPsec and wireless protocols), or full 128 bits (16 bytes) for maximum security. For TDES-CMAC, use minimum 64 bits (8 bytes), with 80 bits (10 bytes) or full 64 bits (8 bytes) output typical. Truncation affects security strength: 96-bit MAC provides 2^96 collision resistance and 2^48 forgery resistance, 64-bit MAC provides 2^64 collision resistance and 2^32 forgery resistance (marginal for high-value data). Never truncate below 64 bits for security-critical applications. Truncation is done by taking leftmost (most significant) bytes of full CMAC output.

CMAC

📖 How to Use CMAC Calculator

CMAC FAQ