The AES-CMAC-96 Algorithm and Its Use with IPsec
Extracted elements (11)
AES-CMAC is appropriate for information systems in which AES is more readily available than a hash function, providing an alternative to HMAC for systems where AES hardware acceleration exists but hash functions are less accessible.
OMAC1 (equivalently CMAC) was chosen because it efficiently reduces the key size of XCBC while addressing the security deficiencies of basic CBC-MAC, resulting in a single-key construction with strong security properties.
As of the time of writing, there are no known issues that preclude the use of AES-CMAC-96 with any specific ESP cipher algorithm.
The 96-bit output of AES-CMAC-96 meets the default authenticator length specified in the IP Authentication Header (AH) RFC 4302, ensuring compatibility with standard IPsec implementations.
For IPsec message authentication on AH and ESP, AES-CMAC-96 should be used.
AES-CMAC-96 is the IPsec AH and ESP MAC generation function based on AES-CMAC, which truncates the 96 most significant bits (12 octets) of the 128-bit AES-CMAC output in MSB-first order.
The key K for AES-CMAC-96 is a 128-bit (16-octet) key used for the AES-128 cipher block operation.
Truncation of the AES-CMAC output is performed in most-significant-bit-first (MSB-first) order using the truncate(T, l) operation, where l is 12 octets for AES-CMAC-96.
IANA allocated value 8 for IKEv2 Transform Type 3 (Integrity Algorithm) to the AUTH_AES_CMAC_96 algorithm.
Security considerations for AES-CMAC-96 are inherited from AES-CMAC (RFC 4493). According to NIST, at least 64 bits should be used against guessing attacks; AES-CMAC-96 uses 96 bits, exceeding this minimum.
AES-CMAC-96 takes a 128-bit (16-octet) key K, a message M, and message length len as input, applies AES-CMAC to produce a 128-bit output T, then truncates T to 12 octets (96 bits) in MSB-first order to produce the authenticator.