AES-CMAC

Overview & Cryptographic Context

CMAC (Cipher-based Message Authentication Code), specified in NIST SP 800-38B and IETF RFC 4493, eliminates the variable-length message forgery vulnerabilities of raw CBC-MAC by XORing the final block with one of two secret subkeys (K₁ or K₂) derived from the block cipher key. If the message length is a positive multiple of the 16-byte block size, the final block is XORed with K₁; otherwise, the partial final block is padded with 10^* (0x80 0x00..., ISO/IEC 9797-1 Method 2) and XORed with K₂.

This workflow verifies RFC 4493 §4 Example 3, where a 40-byte message (two full 16-byte blocks followed by an 8-byte partial block) is authenticated under a 128-bit AES key, exercising the 10^* padding and K₂ subkey masking path. To inspect how K₁ and K₂ are derived inside CMAC, see the companion CMAC subkey generation workflow.

Pipeline Architecture & Wiring Flow

1. Inputs (Workflow Input): Supplies the 16-byte AES-128 key and the 40-byte NIST test message.
2. Block-Cipher Authentication (CMAC Generator): Configured with cipher = "AES". Internally derives subkeys (K₁, K₂), pads the 8-byte tail block to 16 bytes with 8000000000000000, XORs it with K₂, and runs 3 blocks of AES-128-CBC with a zero IV.
3. Tag Output (Workflow Output): Emits the final 16-byte (128-bit) CMAC tag.

Nodes & Configuration

Node reference → · NIST SP 800-38B Padding →

Inputs, Outputs & Test Vector Verification

Verification Source: RFC 4493 §4 (Example 3, len = 40)

Inputs

Expected Outputs