6

OMAC/CMAC only specifies constants for 64-bit (0x1B) and 128-bit (0x87) block size. I would like to know how to get constants for other block sizes.

http://en.wikipedia.org/wiki/CMAC says it "is the non-leading coefficients of the lexicographically first irreducible degree-b binary polynomial with the minimal number of ones.", but I'm not good at math and I don't know how to implement that.

So does anybody know how to implement that?

Thanks.

e-sushi
  • 17,891
  • 12
  • 83
  • 229
LightBit
  • 1,649
  • 13
  • 27
  • 1
    the crypto++ implementation of CMAC specifies the constants for 64, 128, and 256-bit block sizes, if that's any help. – hunter Aug 19 '13 at 12:49
  • I really wanted to know how to get it for any block size. Anyway, it semms incorrect to me. It should be 0x425 not 0x423. – LightBit Aug 20 '13 at 08:26
  • 1
    I believe the polynomial for a 512-bit block cipher, like Kalyna, is x^512 + x^8 + x^5 + x^2 + 1. I know that's Kalyna's polynomial for GCM mode because the Kalyna team provided it in DSTU 7624:2014. I'm not sure if it applies to other modes, like CMAC, or other block ciphers, like Threefish. –  May 13 '17 at 22:28

1 Answers1

7

The identification of the lexicographically first irreducible degree-b binary polynomial with the minimal number of ones can be implemented by testing reducibility (second algorithm) of those
polynomials in order until you get to the first irreducible polynomial in that order.
Alternatively, you could look them up.

The constant itself is then derived from the polynomial by discarding the leading (block size) term and evaluating the remainder for $x = 2$.

e.g. for 256-bit block size:

  • first polynomial is $x^{256} + x^{10} + x^5 + x^2 + 1$
    Note this is is 256,10,5,2 in the linked report, which discards the $+1$ term.
  • discarding first term and evaluating for $x = 2$ gives $2^{10} + 2^5 + 2^2 + 1 = 0x425$
archie
  • 1,988
  • 17
  • 28
  • Why not first algorithm? – LightBit Aug 20 '13 at 08:00
  • I misinterpreted that paper and thought it was saying that the second algorithm was $\hspace{1.18 in}$ faster than the first algorithm. $:$ The first algorithm is fine. $;;;$ –  Aug 21 '13 at 00:48