Problem - Kevin Tafuro

OMAC has been explicitly specified for AES, and it is easy to adapt to any 128-bit
block cipher. It is possible, but a bit more work, to get it working with ciphers with
64-bit blocks. In this section, we only cover using OMAC with AES.
The basic idea behind using CBC mode as a MAC is to encrypt a message in CBC
mode and throw away everything except the very last block of output. That’s not
generally secure, though. It only works when all messages you might possibly process
are a particular size.
Besides OMAC, there are several MACs that try to fix the CBC-MAC problem,
including XCBC-MAC, TMAC, and RMAC:
RMAC
RMAC (the R stands for randomized) has security issues in the general case, and
is not favored by the cryptographic community. *
XCBC-MAC
XCBC-MAC (eXtended CBC-MAC) is the foundation for TMAC and OMAC,
but it uses three different keys.
TMAC
TMAC uses two keys (thus the T in the name).
OMAC is the first good CBC-MAC derivative that uses a single key. OMAC works
the same way CBC-MAC does until the last block, where it XORs the state with an
additional value before encrypting. That additional value is derived from the result of
encrypting all zeros, and it can be performed at key setup time. That is, the additional
value is key-dependent, not message-dependent.
OMAC is actually the name of a family of MAC algorithms. There are two concrete
versions, OMAC1 and OMAC2, which are slightly different but equally secure.
OMAC1 is slightly preferable because its key setup can be done a few cycles more
quickly than OMAC2’s key setup. NIST is expected to standardize on OMAC1.
First, we provide an incremental API for using OMAC. This code requires linking
against an AES implementation, and also that the macros developed in Recipe 5.5 be
defined (they bridge the API of your AES implementation with this book’s API). The
secure memory function spc_memset( ) from Recipe 13.2 is also required.
To use this API, you must instantiate an SPC_OMAC_CTX object and pass it to the various
API functions. To initialize the context, call either spc_omac1_init( ) or spc_
omac2_init( ), depending on whether you want to use OMAC1 or OMAC2. The initialization
functions always return success unless the key length is invalid, in which
case they return 0. Successful initialization is indicated by a return value of 1.
* Most importantly, RMAC requires the underlying block cipher to protect against related-key attacks, where
other constructs do not. Related-key attacks are not well studied, so it’s best to prefer constructs that can
avoid them when possible.
Using OMAC (a Simple Block Cipher–Based MAC) | 281
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.