CBC-MAC, CMAC and hashes built from block ciphers

CBC-MAC and CMAC build a message authentication code from a block cipher alone: AES encrypts the message in CBC mode with a zero IV, the last block is the tag, and CMAC first mixes a subkey into that last block. RFC 4493 publishes four test messages of 0, 16, 40 and 64 bytes with their CMAC tags, the first of which is bb1d6929…, and a correct implementation reproduces all four.

The same chaining idea gives hashes built from block ciphers, and it goes wrong there in a different way. This lesson tests a raw CBC-MAC for forgeries and shows how CMAC’s two subkeys repair it, reproduces RFC 4493, searches a toy hash for preimages before and after the Davies-Meyer step, and ends with a rule for choosing between HMAC, KMAC, CMAC and authenticated encryption.

A block cipher can authenticate a message, and it can be chained into a hash

CBC-MACCBC-MAC: A message authentication code made from a block cipher: the message is encrypted in CBC mode with a zero IV, and the last ciphertext block is the tag. (HAC’s Algorithm 9.58) is CBC encryption with the IV fixed at zero. The chain starts at zero, each message block is XORed into it and encrypted, and only the last output is kept as the tag: H₁ = E(K, m₁), H_i = E(K, H_i−1 ⊕ m_i), and the tag is the last H. A receiver that shares the key recomputes the tag and compares it, and whoever lacks the key cannot make a tag for a message of their choice, which is the property this lesson puts to the test. Step through the chain on the first two blocks of RFC 4493’s message:

The drawing shows the whole scene; its 6 steps are listed below.

Every step as text

1. The start. CBC-MAC is CBC encryption with the IV fixed at zero. It keeps no ciphertext except the last block, and that block is the tag.
2. Block 1. The first block of the message, 6bc1bee2…172a, is XORed with the chain value 0, which changes nothing.
3. Encrypt. AES under the key 2b7e1516…4f3c turns it into H1 = 3ad77bb40d7a3660a89ecaf32466ef97.
4. Block 2. The second block, ae2d8a57…8e51, is XORed with H1 and gives 94faf1e313799afc3629a55f61c961c6.
5. Encrypt again. AES gives H2 = b148c17f309ee692287ae57cf12add49. A longer message goes on in the same way, one AES call for each block.
6. The tag. The last output is the tag. The earlier outputs were only inputs of the next call and are thrown away.

CMACCMAC: The block-cipher MAC of NIST SP 800-38B and RFC 4493, known as AES-CMAC with AES. It derives two subkeys from the key and XORs one into the last block, so messages of any length are handled., standardised in NIST SP 800-38B and RFC 4493, keeps the chain and changes only its last block. It derives two subkeys from the one key and XORs one of them into the final block, which lets it handle a message of any length, the empty message included. Hashes built from block ciphers have no secret key. In the design this lesson follows, each message block is the key of the cipher, and a chaining valuechaining value: The value that one step of an iterated construction passes to the next, such as the running block of CBC-MAC or the state of a hash. The last one is the output. passes from block to block. The plain chain computes H_i = E(M_i, H_i−1), and the Davies-MeyerDavies-Meyer: A way to build a hash function from a block cipher: the message block is the cipher key, and the old chaining value is added back to the output, H(i) = E(M(i), H(i-1)) XOR H(i-1). hash of HAC’s Algorithm 9.42 adds the old value back: H_i = E(M_i, H_i−1) ⊕ H_i−1. CBC-MAC, CMAC and hashes built from block ciphers share one shape, a block cipher run along a chain. A hash has no secret to protect it, so every step of its chain is open to a searcher, and the rest of the lesson is about where each of them holds and where it breaks.

CMAC treats the last block with a subkey, and RFC 4493 confirms it Pro: opens with a Pro, Premium or Ultimate pass

In this part:

• Raw CBC-MAC accepts a longer message with the same tag
• A chained block cipher is not yet a hash, and Davies-Meyer adds the missing step
• A tag needs 64 bits and a key needs a message limit
• Node.js 24 has HMAC and no CMAC, so choose by what the system needs
• Practise: build CMAC and a verifier that checks the length
  • Build CMAC and a CBC-MAC verifier that checks the length
• Interview questions
  • What is CBC-MAC, and what does CMAC change?
  • A device SDK tags messages of 1 to 200 bytes with AES-CBC, a zero IV, zero padding to whole blocks and the last block as the tag. Review the design: what can someone do without the key, how do you show it with a test on your own system, and what replaces it?
  • A teammate proposes hashing uploaded files with AES in Davies-Meyer mode, to avoid a new dependency. Evaluate it: what do you compute first, what does a toy version show about the feed-forward, what are the digest numbers, and what do you recommend instead?
  • A sensor has hardware AES and no hash function, and the server runs Node.js 24. Every message needs integrity and some need secrecy. Choose the primitives and the tag length, set a limit for each key, and say what you test on both ends.
• Key takeaways

3 diagrams · 8 runnable examples (JavaScript, Python) · 1 exercise with sample tests · 3 interview answers · about 45 minutes

Opening this part with your pass…

This part opens with any MySmartCoPilot pass.

• Pro pass · 1 week · ₹79 · $2.99
• 30 days · ₹179 · $5.99
• 1 year · ₹1,699 · $45

One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.

Choose a passI have a licence key

It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).

Terms in this lesson

CBC-MAC

A message authentication code made from a block cipher: the message is encrypted in CBC mode with a zero IV, and the last ciphertext block is the tag.

chaining value

The value that one step of an iterated construction passes to the next, such as the running block of CBC-MAC or the state of a hash. The last one is the output.

CMAC

The block-cipher MAC of NIST SP 800-38B and RFC 4493, known as AES-CMAC with AES. It derives two subkeys from the key and XORs one into the last block, so messages of any length are handled.

Davies-Meyer

A way to build a hash function from a block cipher: the message block is the cipher key, and the old chaining value is added back to the output, H(i) = E(M(i), H(i-1)) XOR H(i-1).

existential forgery

A valid message and tag pair for some message the key holder never tagged, even a meaningless one. A secure MAC makes it infeasible without the key.