CMAC subkey generation

Overview & Cryptographic Context

In RFC 4493 §2.3 (NIST SP 800-38B), AES-CMAC derives two 128-bit subkeys K₁ and K₂ from the block cipher key K. First, the cipher encrypts a 128-bit all-zero block L = AES_K(0¹²⁸). Then K₁ = L · x and K₂ = K₁ · x are computed by multiplying by x (left-shifting by 1 bit) in the finite field GF(2¹²⁸) modulo the irreducible polynomial x¹²⁸ + x⁷ + x² + x + 1 (whose reduction constant is R₁₂₈ = 0x00…0087).

This workflow demonstrates how to combine standard cryptographic primitives with the deterministic Script node to express custom byte-level finite-field arithmetic and inspect intermediate values (L, K₁, K₂) directly on the canvas.

Pipeline Architecture & Script Logic

The Script node receives the 16-byte ciphertext L on input port l and executes the following built-in script:

def dbl(x: bytes) -> bytes:
    rb = h"00" * (len(x) - 1) + (h"87" if len(x) == 16 else h"1b")
    r = x << 1
    if x[0] & 0x80 != 0:
        r ^= rb
    return r

k1 = dbl(l)
k2 = dbl(k1)

Nodes & Configuration

Node reference → · Built-in Script language reference →

Inputs, Outputs & Test Vector Verification

Verification Source: RFC 4493 §4 (Subkey Generation: K1, K2)

Static Node Inputs

Expected Outputs