Counter with CBC-MAC (CCM)
RFC 3610

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 02

Network Working Group                                         D. Whiting
Request for Comments: 3610                                          Hifn
Category: Informational                                       R. Housley
                                                          Vigil Security
                                                             N. Ferguson
                                                               MacFergus
                                                          September 2003

                       Counter with CBC-MAC (CCM)

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2003).  All Rights Reserved.

Abstract

   Counter with CBC-MAC (CCM) is a generic authenticated encryption
   block cipher mode.  CCM is defined for use with 128-bit block
   ciphers, such as the Advanced Encryption Standard (AES).

1.  Introduction

   Counter with CBC-MAC (CCM) is a generic authenticated encryption
   block cipher mode.  CCM is only defined for use with 128-bit block
   ciphers, such as AES [AES].  The CCM design principles can easily be
   applied to other block sizes, but these modes will require their own
   specifications.

1.1.  Conventions Used In This Document

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [STDWORDS].

2.  CCM Mode Specification

   For the generic CCM mode there are two parameter choices.  The first
   choice is M, the size of the authentication field.  The choice of the
   value for M involves a trade-off between message expansion and the
   probability that an attacker can undetectably modify a message.
   Valid values are 4, 6, 8, 10, 12, 14, and 16 octets.  The second

Whiting, et al.              Informational                      [Page 1]
RFC 3610               Counter with CBC-MAC (CCM)         September 2003

   choice is L, the size of the length field.  This value requires a
   trade-off between the maximum message size and the size of the Nonce.
   Different applications require different trade-offs, so L is a
   parameter.  Valid values of L range between 2 octets and 8 octets
   (the value L=1 is reserved).

       Name  Description                               Size    Encoding
       ----  ----------------------------------------  ------  --------
       M     Number of octets in authentication field  3 bits  (M-2)/2
       L     Number of octets in length field          3 bits  L-1

2.1.  Inputs

   To authenticate and encrypt a message the following information is
   required:

   1.  An encryption key K suitable for the block cipher.

   2.  A nonce N of 15-L octets.  Within the scope of any encryption key
       K, the nonce value MUST be unique.  That is, the set of nonce
       values used with any given key MUST NOT contain any duplicate
       values.  Using the same nonce for two different messages
       encrypted with the same key destroys the security properties of
       this mode.

   3.  The message m, consisting of a string of l(m) octets where 0 <=
       l(m) < 2^(8L).  The length restriction ensures that l(m) can be
       encoded in a field of L octets.

   4.  Additional authenticated data a, consisting of a string of l(a)
       octets where 0 <= l(a) < 2^64.  This additional data is
       authenticated but not encrypted, and is not included in the
       output of this mode.  It can be used to authenticate plaintext
       packet headers, or contextual information that affects the
       interpretation of the message.  Users who do not wish to
       authenticate additional data can provide a string of length zero.

   The inputs are summarized as:

      Name  Description                          Size
      ----  -----------------------------------  -----------------------
      K     Block cipher key                     Depends on block cipher
      N     Nonce                                15-L octets
      m     Message to authenticate and encrypt  l(m) octets
      a     Additional authenticated data        l(a) octets

Whiting, et al.              Informational                      [Page 2]
RFC 3610               Counter with CBC-MAC (CCM)         September 2003

2.2.  Authentication

   The first step is to compute the authentication field T.  This is
   done using CBC-MAC [MAC].  We first define a sequence of blocks B_0,
   B_1, ..., B_n and then apply CBC-MAC to these blocks.

   The first block B_0 is formatted as follows, where l(m) is encoded in
   most-significant-byte first order:

      Octet Number   Contents
      ------------   ---------
      0              Flags
      1 ... 15-L     Nonce N
      16-L ... 15    l(m)

   Within the first block B_0, the Flags field is formatted as follows: