The AES-CMAC-96 Algorithm and Its Use with IPsec
RFC 4494

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 04

Network Working Group                                           JH. Song
Request for Comments: 4494                                 R. Poovendran
Category: Standards Track                       University of Washington
                                                                  J. Lee
                                                     Samsung Electronics
                                                               June 2006

            The AES-CMAC-96 Algorithm and Its Use with IPsec

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2006).

Abstract

   The National Institute of Standards and Technology (NIST) has
   recently specified the Cipher-based Message Authentication Code
   (CMAC), which is equivalent to the One-Key CBC-MAC1 (OMAC1) algorithm
   submitted by Iwata and Kurosawa.  OMAC1 efficiently reduces the key
   size of Extended Cipher Block Chaining mode (XCBC).  This memo
   specifies the use of CMAC mode on the authentication mechanism of the
   IPsec Encapsulating Security Payload (ESP) and the Authentication
   Header (AH) protocols.  This new algorithm is named AES-CMAC-96.

Song, et al.                Standards Track                     [Page 1]
RFC 4494            The AES-CMAC Algorithm and IPsec           June 2006

1.  Introduction

   The National Institute of Standards and Technology (NIST) has
   recently specified the Cipher-based Message Authentication Code
   (CMAC).  CMAC [NIST-CMAC] is a message authentication code that is
   based on a symmetric key block cipher such as the Advanced Encryption
   Standard [NIST-AES].  CMAC is equivalent to the One-Key CBC MAC1
   (OMAC1) submitted by Iwata and Kurosawa [OMAC1a, OMAC1b].  OMAC1 is
   an improvement of the eXtended Cipher Block Chaining mode (XCBC)
   submitted by Black and Rogaway [XCBCa, XCBCb], which itself is an
   improvement of the basic CBC-MAC.  XCBC efficiently addresses the
   security deficiencies of CBC-MAC, and OMAC1 efficiently reduces the
   key size of XCBC.

   This memo specifies the usage of CMAC on the authentication mechanism
   of the IPsec Encapsulating Security Payload [ESP] and Authentication
   Header [AH] protocols.  This new algorithm is named AES-CMAC-96.  For
   further information on AH and ESP, refer to [AH] and [ROADMAP].

2.  Basic Definitions

   CBC             Cipher Block Chaining mode of operation for message
                   authentication code.

   MAC             Message Authentication Code.
                   A bit string of a fixed length, computed by the MAC
                   generation algorithm, that is used to establish the
                   authority and, hence, the integrity of a message.

   CMAC            Cipher-based MAC based on an approved symmetric key
                   block cipher, such as the Advanced Encryption
                   Standard.

   Key (K)         128-bit (16-octet) key for AES-128 cipher block.
                   Denoted by K.

   Message (M)     Message to be authenticated.
                   Denoted by M.

   Length (len)    The length of message M in octets.
                   Denoted by len.
                   The minimum value is 0.  The maximum value is not
                   specified in this document.

   truncate(T,l)   Truncate T (MAC) in most-significant-bit-first
                   (MSB-first) order to a length of l octets.

   T               The output of AES-CMAC.

Song, et al.                Standards Track                     [Page 2]
RFC 4494            The AES-CMAC Algorithm and IPsec           June 2006

   Truncated T     The truncated output of AES-CMAC-128 in MSB-first
                   order.

   AES-CMAC        CMAC generation function based on AES block cipher
                   with 128-bit key.

   AES-CMAC-96     IPsec AH and ESP MAC generation function based on
                   AES-CMAC, which truncates the 96 most significant
                   bits of the 128-bit output.

3.  AES-CMAC

   The core of AES-CMAC-96 is the AES-CMAC [AES-CMAC].  The underlying
   algorithms for AES-CMAC are the Advanced Encryption Standard cipher
   block [NIST-AES] and the recently defined CMAC mode of operation
   [NIST-CMAC].  AES-CMAC provides stronger assurance of data integrity
   than a checksum or an error detecting code.  The verification of a
   checksum or an error detecting code detects only accidental
   modifications of the data, while CMAC is designed to detect
   intentional, unauthorized modifications of the data, as well as
   accidental modifications.  The output of AES-CMAC can validate the
   input message.  Validating the message provides assurance of the