CMAC Security API
Version: 1.0.0
Last Updated: 2025-01-02
Security Classification: Message Authentication Code
Author: MetaMUI Security Team
Overview
CMAC (Cipher-based MAC) is a block cipher-based message authentication code using AES, providing authentication and integrity.
- Algorithm Family: Block cipher-based MAC
- Security Level: 128-bit with AES-256
- Tag Size: 128 bits (16 bytes)
- Underlying Cipher: AES-256
- Standard: NIST SP 800-38B
Security Warnings ⚠️
- Key Management: Never reuse keys between CMAC and encryption
- Tag Truncation: Avoid truncating tags below 64 bits
- Nonce-less: Does not use nonces (deterministic)
- Block Cipher Based: Security depends on AES
API Functions
MAC Generation
def cmac_generate(key: bytes, message: bytes) -> bytes:
"""Generate CMAC tag for message"""
MAC Verification
def cmac_verify(key: bytes, message: bytes, tag: bytes) -> bool:
"""Verify CMAC tag (constant-time)"""
Security Best Practices
- Use unique keys for CMAC
- Never truncate below 64 bits
- Use constant-time comparison for verification
- Consider HMAC for hash-based alternative
Security Analysis
Threat Model: CMAC Threat Model
The comprehensive threat analysis covers:
- Algorithm-specific attack vectors
- Implementation vulnerabilities
- Side-channel considerations
- Quantum resistance analysis (where applicable)
- Deployment recommendations
For complete security analysis and risk assessment, see the dedicated threat model documentation.