CMAC Generator

Category: Hash & MAC & CRC · Node Type ID: mac-cmac

NIST SP 800-38B Cipher-based MAC (AES-128/256 or 3DES)

Overview

Computes a Cipher-based Message Authentication Code (CMAC / OMAC1) as standardized in NIST SP 800-38B and RFC 4493 using either AES (128/192/256-bit) or Triple-DES (TDES) (112/168-bit).

CMAC derives two subkeys ($K_1, K_2$) from the block cipher encryption of an all-zero block and XORs the final block with $K_1$ (if complete) or $K_2$ (after ISO/IEC 9797-1 Method 2 padding if partial), completely avoiding the length-extension vulnerabilities of raw CBC-MAC.

When to Use

Authenticating messages in embedded, automotive (AUTOSAR SecOC), smartcard (EMV / GlobalPlatform), or NIST SP 800-108 counter-mode KDF protocols that standardize on block-cipher MACs.
Generating a 16-byte (AES-CMAC) or 8-byte (TDES-CMAC) authentication tag using hardware/software environments centered on AES or 3DES.

Parameter Configuration

Parameter (ID)	Type & Default	Visibility Condition	Description & Options
Underlying Cipher `cipher`	`select` Default: `AES`	Always visible	Selects the underlying block cipher: `AES` (16-byte tag; accepts 16, 24, or 32-byte keys) or `TDES` (8-byte tag; accepts 16 or 24-byte keys). `AES`: AES-128 / AES-256 `3DES`: Triple DES (3DES)

Port I/O Specification

See Ports & Connections for general wiring rules, data type colors, and dynamic port creation.

Input Ports

Port Nature: Fixed Input Ports (2 total).

Port Name	Port ID	Data Type	Required	Visibility Condition	Description
`Cipher Key`	`key`	`Bytes`	Required	Always visible	Symmetric key (`16`, `24`, or `32` bytes when `Cipher = AES`; `16` or `24` bytes when `Cipher = TDES`).
`Message`	`data`	`Bytes`	Required	Always visible	Message payload (`Uint8Array`) of any length (including 0 bytes) to authenticate.

Output Ports

Port Nature: Fixed Output Ports (1 total).

Port Name	Port ID	Data Type	Visibility Condition	Description
`CMAC Tag`	`mac`	`Bytes`	Always visible

Error Cases

When any of the following conditions occurs at runtime, this node transitions to an ERROR state and downstream nodes connected to its outputs do not execute.

Error Code	Default Engine Message	Trigger Condition
`INVALID_KEY_LENGTH`	Invalid key length	Raised when the `Key` length does not match the selected cipher (must be 16/24/32 bytes for AES, or 16/24 bytes for TDES).

Examples

Computing an RFC 4493 AES-128-CMAC Tag

Authenticate a message with a 16-byte AES key.

Set Underlying Cipher to AES (128 / 192 / 256-bit).
Connect a 16-byte key to Key and your payload to Message; CMAC Tag outputs the 16-byte tag.