Skip to content

Block-cipher MACs

CMAC and GMAC: MACs built from AES instead of a hash. Why plain CBC-MAC isn't enough, and where these two run.

Status and standards: see MAC in the main table.

What it is

A MAC can be built from a block cipher instead of a hash, which suits hardware that has AES and little else: smart cards, payment HSMs, the radio chip in a phone.

  • CMAC runs AES in CBC mode and keeps the last block, with a fix that makes it safe for any message length.
  • GMAC is GCM with nothing to encrypt: a polynomial hash over GF(2¹²⁸), masked with AES of a nonce.

How it works

CBC-MAC, and why it fails

CBC-MAC encrypts the message in CBC mode with a zero IV and keeps the last block. The DES version was FIPS 113 (1985, withdrawn 2008). Bellare, Kilian and Rogaway proved it secure when all messages have the same number of blocks (CRYPTO 1994).

With mixed lengths it breaks. If t is the tag of a one-block message m, then m ‖ (m ⊕ t) also has tag t: the second block reaches the cipher as t ⊕ m ⊕ t = m, the same input as before. One tag is enough to extend a message without the key.

CMAC

Black and Rogaway's XCBC (CRYPTO 2000) fixed CBC-MAC with three keys. Iwata and Kurosawa cut that to one key with OMAC (FSE 2003), then OMAC1, which NIST adopted as CMAC in SP 800-38B (2005). RFC 4493 (2006) has AES-CMAC with test vectors.

  • L = AES(K, 0¹²⁸). K1 is L shifted left one bit, with 0x87 XORed into the last byte if a bit fell off. K2 is K1 done the same way.
  • Run CBC-MAC over every block but the last.
  • XOR K1 into a full last block, or pad a short one with 0x80 and zeros and XOR K2. Encrypting it gives the tag.

The secret mask means a tag is no longer the chaining value a longer message would carry on from, so the trick above stops working.

SP 800-38B says a tag of at least 64 bits suits most uses, and one AES key should tag no more than 2⁴⁸ messages. NIST decided in April 2025 to revise it, matching CCM's tag-length rules and dropping Triple DES.

GMAC

SP 800-38D (2007) defines GCM and GMAC, its variant with no plaintext. The hash key is H = AES(K, 0¹²⁸). GHASH evaluates the message blocks as a polynomial at H, and the tag is that value XOR AES(K, J0), where J0 comes from the IV. It is the Wegman–Carter idea, like Poly1305.

The IV must never repeat under one key. Two tags with one IV give an equation in H, and solving it lets you forge anything (Joux, 2006). SP 800-38D calls this "almost as important as the secrecy of the key". NIST decided in 2024 to revise SP 800-38D and drop tags under 96 bits. Its second call for comments (June 2026) adds wGCM, for 256-bit blocks.

Where they're used

  • 4G and 5G: the integrity algorithms 128-EIA2 and 128-NIA2 are AES-CMAC with a 32-bit tag.
  • Smart cards: GlobalPlatform SCP03, the secure channel for managing card applets, MACs each command and response with AES-CMAC cut to 8 bytes.
  • Banking: payment HSMs exchange keys in TR-31 / ANSI X9.143 key blocks. The AES version (D) binds each block with AES-CMAC.
  • IPsec: AES-CMAC-96 in AH and ESP (RFC 4494), AES-CMAC-PRF-128 in IKE (RFC 4615), and GMAC for integrity-only ESP and AH (RFC 4543).

When to use it

  • CMAC when a standard or device calls for it, or AES is all the hardware has.
  • GMAC when GCM hardware is there, nothing needs encrypting, and every message can get a fresh IV.
  • Otherwise HMAC-SHA-256, which needs no nonce and has no 2⁴⁸ limit. See HMAC.
  • If you also encrypt, use an AEAD, not CBC plus CMAC.

Example (Python)

CMAC only runs AES forwards, so a keyed hash stands in, as on the Disk encryption page. With a real AES as E, cmac() gives the RFC 4493 test vectors.

import hmac

def E(k, b):                             # stand-in for AES: a keyed hash
    return hmac.digest(k, b, "sha256")[:16]

def xor(a, b):
    return bytes(x ^ y for x, y in zip(a, b))

def cbc_mac(k, m):                       # raw CBC-MAC, whole 16-byte blocks
    t = bytes(16)
    for i in range(0, len(m), 16):
        t = E(k, xor(t, m[i:i + 16]))
    return t

def dbl(b):                              # multiply by x in GF(2^128)
    n = int.from_bytes(b, "big") << 1
    if n >> 128:
        n ^= (1 << 128) | 0x87
    return n.to_bytes(16, "big")

def cmac(k, m):                          # RFC 4493, Section 2.4
    k1 = dbl(E(k, bytes(16)))
    k2 = dbl(k1)
    if m and len(m) % 16 == 0:
        head, last = m[:-16], xor(m[-16:], k1)
    else:
        r = len(m) % 16
        head, last = m[:len(m) - r], xor(m[len(m) - r:] + b"\x80" + bytes(15 - r), k2)
    return E(k, xor(cbc_mac(k, head), last))

key = bytes.fromhex("2b7e151628aed2a6abf7158809cf4f3c")
m = b"pay Bob $100.00!"                  # one block, tagged by the sender

t = cbc_mac(key, m)
print(cbc_mac(key, m + xor(m, t)) == t)  # True
t = cmac(key, m)
print(cmac(key, m + xor(m, t)) == t)     # False

Raw CBC-MAC accepts a two-block message nobody tagged. The same trick on a CMAC tag fails.

In real code, PyCA cryptography has cmac.CMAC(algorithms.AES(key)), and GMAC is AESGCM(key).encrypt(nonce, b"", data), which returns only the 16-byte tag. Those need the library and weren't run for this page.

Security notes

  • Compare tags in constant time, as with HMAC.
  • Use a CMAC key only for CMAC, not also for CBC encryption.
  • One repeated GMAC IV gives away H. Use a counter or another IV scheme that can't repeat.
  • Short tags, such as 5G's 32 bits, are safe only where the protocol caps how many forgeries anyone can try.

See also

References

Weaker sources: Kisley, "X9.143 and PCI PIN Compliant Key Blocks" (PCI SSC talk, 2022) for CMAC in version D key blocks; the iTecSpec mirror of the 3GPP text, read in place of the official files.