Network Working Group D. Whiting Request for Comments: 3610 Hifn Category: Informational R. Housley Vigil Security N. Ferguson MacFergus September 2003
Counter with CBC-MAC (CCM)
Status of this Memo
This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2003). All Rights Reserved.
Abstract
Counter with CBC-MAC (CCM) is a generic authenticated encryption block cipher mode. CCM is defined for use with 128-bit block ciphers, such as the Advanced Encryption Standard (AES).
Counter with CBC-MAC (CCM) is a generic authenticated encryption block cipher mode. CCM is only defined for use with 128-bit block ciphers, such as AES [AES]. The CCM design principles can easily be applied to other block sizes, but these modes will require their own specifications.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [STDWORDS].
For the generic CCM mode there are two parameter choices. The first choice is M, the size of the authentication field. The choice of the value for M involves a trade-off between message expansion and the probability that an attacker can undetectably modify a message. Valid values are 4, 6, 8, 10, 12, 14, and 16 octets. The second
Whiting, et al. Informational [Page 1]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
choice is L, the size of the length field. This value requires a trade-off between the maximum message size and the size of the Nonce. Different applications require different trade-offs, so L is a parameter. Valid values of L range between 2 octets and 8 octets (the value L=1 is reserved).
Name Description Size Encoding ---- ---------------------------------------- ------ -------- M Number of octets in authentication field 3 bits (M-2)/2 L Number of octets in length field 3 bits L-1
To authenticate and encrypt a message the following information is required:
1. An encryption key K suitable for the block cipher.
2. A nonce N of 15-L octets. Within the scope of any encryption key K, the nonce value MUST be unique. That is, the set of nonce values used with any given key MUST NOT contain any duplicate values. Using the same nonce for two different messages encrypted with the same key destroys the security properties of this mode.
3. The message m, consisting of a string of l(m) octets where 0 <= l(m) < 2^(8L). The length restriction ensures that l(m) can be encoded in a field of L octets.
4. Additional authenticated data a, consisting of a string of l(a) octets where 0 <= l(a) < 2^64. This additional data is authenticated but not encrypted, and is not included in the output of this mode. It can be used to authenticate plaintext packet headers, or contextual information that affects the interpretation of the message. Users who do not wish to authenticate additional data can provide a string of length zero.
The inputs are summarized as:
Name Description Size ---- ----------------------------------- ----------------------- K Block cipher key Depends on block cipher N Nonce 15-L octets m Message to authenticate and encrypt l(m) octets a Additional authenticated data l(a) octets
Whiting, et al. Informational [Page 2]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
The first step is to compute the authentication field T. This is done using CBC-MAC [MAC]. We first define a sequence of blocks B_0, B_1, ..., B_n and then apply CBC-MAC to these blocks.
The first block B_0 is formatted as follows, where l(m) is encoded in most-significant-byte first order:
Octet Number Contents ------------ --------- 0 Flags 1 ... 15-L Nonce N 16-L ... 15 l(m)
Within the first block B_0, the Flags field is formatted as follows:
Bit Number Contents ---------- ---------------------- 7 Reserved (always zero) 6 Adata 5 ... 3 M' 2 ... 0 L'
Another way say the same thing is: Flags = 64*Adata + 8*M' + L'.
The Reserved bit is reserved for future expansions and should always be set to zero. The Adata bit is set to zero if l(a)=0, and set to one if l(a)>0. The M' field is set to (M-2)/2. As M can take on the even values from 4 to 16, the 3-bit M' field can take on the values from one to seven. The 3-bit field MUST NOT have a value of zero, which would correspond to a 16-bit integrity check value. The L' field encodes the size of the length field used to store l(m). The parameter L can take on the values from 2 to 8 (recall, the value L=1 is reserved). This value is encoded in the 3-bit L' field using the values from one to seven by choosing L' = L-1 (the zero value is reserved).
If l(a)>0 (as indicated by the Adata field), then one or more blocks of authentication data are added. These blocks contain l(a) and a encoded in a reversible manner. We first construct a string that encodes l(a).
If 0 < l(a) < (2^16 - 2^8), then the length field is encoded as two octets which contain the value l(a) in most-significant-byte first order.
Whiting, et al. Informational [Page 3]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
If (2^16 - 2^8) <= l(a) < 2^32, then the length field is encoded as six octets consisting of the octets 0xff, 0xfe, and four octets encoding l(a) in most-significant-byte-first order.
If 2^32 <= l(a) < 2^64, then the length field is encoded as ten octets consisting of the octets 0xff, 0xff, and eight octets encoding l(a) in most-significant-byte-first order.
The length encoding conventions are summarized in the following table. Note that all fields are interpreted in most-significant-byte first order.
First two octets Followed by Comment ----------------- ---------------- ------------------------------- 0x0000 Nothing Reserved 0x0001 ... 0xFEFF Nothing For 0 < l(a) < (2^16 - 2^8) 0xFF00 ... 0xFFFD Nothing Reserved 0xFFFE 4 octets of l(a) For (2^16 - 2^8) <= l(a) < 2^32 0xFFFF 8 octets of l(a) For 2^32 <= l(a) < 2^64
The blocks encoding a are formed by concatenating this string that encodes l(a) with a itself, and splitting the result into 16-octet blocks, and then padding the last block with zeroes if necessary. These blocks are appended to the first block B0.
After the (optional) additional authentication blocks have been added, we add the message blocks. The message blocks are formed by splitting the message m into 16-octet blocks, and then padding the last block with zeroes if necessary. If the message m consists of the empty string, then no blocks are added in this step.
The result is a sequence of blocks B0, B1, ..., Bn. The CBC-MAC is computed by:
X_1 := E( K, B_0 ) X_i+1 := E( K, X_i XOR B_i ) for i=1, ..., n T := first-M-bytes( X_n+1 )
where E() is the block cipher encryption function, and T is the MAC value. CCM was designed with AES in mind for the E() function, but any 128-bit block cipher can be used. Note that the last block B_n is XORed with X_n, and the result is encrypted with the block cipher. If needed, the ciphertext is truncated to give T.
Whiting, et al. Informational [Page 4]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
To encrypt the message data we use Counter (CTR) mode. We first define the key stream blocks by:
S_i := E( K, A_i ) for i=0, 1, 2, ...
The values A_i are formatted as follows, where the Counter field i is encoded in most-significant-byte first order:
Octet Number Contents ------------ --------- 0 Flags 1 ... 15-L Nonce N 16-L ... 15 Counter i
The Flags field is formatted as follows:
Bit Number Contents ---------- ---------------------- 7 Reserved (always zero) 6 Reserved (always zero) 5 ... 3 Zero 2 ... 0 L'
Another way say the same thing is: Flags = L'.
The Reserved bits are reserved for future expansions and MUST be set to zero. Bit 6 corresponds to the Adata bit in the B_0 block, but as this bit is not used here, it is reserved and MUST be set to zero. Bits 3, 4, and 5 are also set to zero, ensuring that all the A blocks are distinct from B_0, which has the non-zero encoding of M in this position. Bits 0, 1, and 2 contain L', using the same encoding as in B_0.
The message is encrypted by XORing the octets of message m with the first l(m) octets of the concatenation of S_1, S_2, S_3, ... . Note that S_0 is not used to encrypt the message.
The authentication value U is computed by encrypting T with the key stream block S_0 and truncating it to the desired length.
Decryption starts by recomputing the key stream to recover the message m and the MAC value T. The message and additional authentication data is then used to recompute the CBC-MAC value and check T.
If the T value is not correct, the receiver MUST NOT reveal any information except for the fact that T is incorrect. The receiver MUST NOT reveal the decrypted message, the value T, or any other information.
To preserve security, implementations need to limit the total amount of data that is encrypted with a single key; the total number of block cipher encryption operations in the CBC-MAC and encryption together cannot exceed 2^61. (This allows nearly 2^64 octets to be encrypted and authenticated using CCM. This is roughly 16 million terabytes, which should be more than enough for most applications.) In an environment where this limit might be reached, the sender MUST ensure that the total number of block cipher encryption operations in the CBC-MAC and encryption together does not exceed 2^61. Receivers that do not expect to decrypt the same message twice MAY also check this limit.
The recipient MUST verify the CBC-MAC before releasing any information such as the plaintext. If the CBC-MAC verification fails, the receiver MUST destroy all information, except for the fact that the CBC-MAC verification failed.
Jakob Jonsson has developed a security proof of CCM [PROOF]. The resulting paper was presented at the SAC 2002 conference. The proof shows that CCM provides a level of confidentiality and authenticity that is in line with other proposed authenticated encryption modes, such as OCB mode [OCB].
Whiting, et al. Informational [Page 6]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
The main difficulty in specifying this mode is the trade-off between nonce size and counter size. For a general mode we want to support large messages. Some applications use only small messages, but would rather have a larger nonce. Introducing the L parameter solves this issue. The parameter M gives the traditional trade-off between message expansion and probability of forgery. For most applications, we recommend choosing M at least 8.
The CBC-MAC is computed over a sequence of blocks that encode the relevant data in a unique way. Given the block sequence it is easy to recover N, M, L, m, and a. The length encoding of a was chosen to be simple and efficient when a is empty and when a is small. We expect that many implementations will limit the maximum size of a.
CCM encryption is a straightforward application of CTR mode [MODES]. As some implementations will support a variable length counter field, we have ensured that the least significant octet of the counter is at one end of the field. This also ensures that the counter is aligned on the block boundary.
By encrypting T we avoid CBC-MAC collision attacks. If the block cipher behaves as a pseudo-random permutation, then the key stream is indistinguishable from a random string. Thus, the attacker gets no information about the CBC-MAC results. The only avenue of attack that is left is a differential-style attack, which has no significant chance of success if the block cipher is a pseudo-random permutation.
To simplify implementation we use the same block cipher key for the encryption and authentication functions. In our design this is not a problem. All the A blocks are different, and they are different from the B_0 block. If the block cipher behaves like a random permutation, then the outputs are independent of each other, up to the insignificant limitation that they are all different. The only cases where the inputs to the block cipher can overlap are an intermediate value in the CBC-MAC and one of the other encryptions. As all the intermediate values of the CBC-MAC computation are essentially random (because the block cipher behaves like a random permutation) the probability of such a collision is very small. Even if there is a collision, these values only affect T, which is encrypted so that an attacker cannot deduce any information, or detect any collision.
Whiting, et al. Informational [Page 7]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
Care has been taken to ensure that the blocks used by the authentication function match up with the blocks used by the encryption function. This should simplify hardware implementations, and reduce the amount of byte-shifting required by software implementations.
The main requirement is that, within the scope of a single key, the nonce values are unique for each message. A common technique is to number messages sequentially, and to use this number as the nonce. Sequential message numbers are also used to detect replay attacks and to detect message reordering, so in many situations (such as IPsec ESP [ESP]) the sequence numbers are already available.
Users of CCM, and all other block cipher modes, should be aware of precomputation attacks. These are effectively collision attacks on the cipher key. Let us suppose the key K is 128 bits, and the same nonce value N' is used with many different keys. The attacker chooses a particular nonce N'. She chooses 2^64 different keys at random and computes a table entry for each K value, generating a pair of the form (K,S_1). (Given the key and the nonce, computing S_1 is easy.) She then waits for messages to be sent with nonce N'. We will assume the first 16 bytes of each message are known so that she can compute S_1 for each message. She looks in her table for a pair with a matching S_1 value. She can expect to find a match after checking about 2^64 messages. Once a match is found, the other part of the matched pair is the key in question. The total workload of the attacker is only 2^64 steps, rather than the expected 2^128 steps. Similar precomputation attacks exist for all block cipher modes.
The main weapon against precomputation attacks is to use a larger key. Using a 256-bit key forces the attacker to perform at least 2^128 precomputations, which is infeasible. In situations where using a large key is not possible or desirable (for example, due to the resulting performance impact), users can use part of the nonce to reduce the number of times any specific nonce value is used with different keys. If there is room in the nonce, the sender could add a few random bytes, and send these random bytes along with the message. This makes the precomputation attack much harder, as the attacker now has to precompute a table for each of the possible random values. An alternative is to use something like the sender's Ethernet address. Note that due to the widespread use of DHCP and NAT, IP addresses are rarely unique. Including the Ethernet address forces the attacker to perform the precomputation specifically for a specific source address, and the resulting table could not be used to attack anyone else. Although these solutions can all work, they need
Whiting, et al. Informational [Page 8]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
careful analysis and almost never entirely prevent these attacks. Where possible, we recommend using a larger key, as this solves all the problems.
Performance depends on the speed of the block cipher implementation. In hardware, for large packets, the speed achievable for CCM is roughly the same as that achievable with the CBC encryption mode.
Encrypting and authenticating an empty message, without any additional authentication data, requires two block cipher encryption operations. For each block of additional authentication data one additional block cipher encryption operation is required (if one includes the length encoding). Each message block requires two block cipher encryption operations. The worst-case situation is when both the message and the additional authentication data are a single octet. In this case, CCM requires five block cipher encryption operations.
CCM results in the minimal possible message expansion; the only bits added are the authentication bits.
Both the CCM encryption and CCM decryption operations require only the block cipher encryption function. In AES, the encryption and decryption algorithms have some significant differences. Thus, using only the encrypt operation can lead to a significant savings in code size or hardware size.
In hardware, CCM can compute the message authentication code and perform encryption in a single pass. That is, the implementation does not have to complete calculation of the message authentication code before encryption can begin.
CCM was designed for use in the packet processing environment. The authentication processing requires the message length to be known at the beginning of the operation, which makes one-pass processing difficult in some environments. However, in almost all environments, message or packet lengths are known in advance.
Whiting, et al. Informational [Page 9]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
Synchronization same nonce used by sender and recipient
Parallelizability encryption can be parallelized, but authentication cannot
Keying Material Requirements one key
Counter/IV/Nonce Requirements counter and nonce are part of the counter block
Memory Requirements requires memory for encrypt operation of the underlying block cipher, plaintext, ciphertext (expanded for CBC-MAC), and a per- packet counter (an integer; at most L octets in size)
Pre-processing Capability encryption key stream can be precomputed, but authentication cannot
Message Length Requirements octet aligned message of arbitrary length, up to 2^(8*L) octets, and octet aligned arbitrary additional authenticated data, up to 2^64 octets
Ciphertext Expansion 4, 6, 8, 10, 12, 14, or 16 octets depending on size of MAC selected
These test vectors use AES for the block cipher [AES]. In each of these test vectors, the least significant sixteen bits of the counter block is used for the block counter, and the nonce is 13 octets. Some of the test vectors include a eight octet authentication value, and others include a ten octet authentication value.
Whiting, et al. Informational [Page 10]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
=============== Packet Vector #1 ================== AES Key = C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF Nonce = 00 00 00 03 02 01 00 A0 A1 A2 A3 A4 A5 Total packet length = 31. [Input with 8 cleartext header octets] 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E CBC IV in: 59 00 00 00 03 02 01 00 A0 A1 A2 A3 A4 A5 00 17 CBC IV out:EB 9D 55 47 73 09 55 AB 23 1E 0A 2D FE 4B 90 D6 After xor: EB 95 55 46 71 0A 51 AE 25 19 0A 2D FE 4B 90 D6 [hdr] After AES: CD B6 41 1E 3C DC 9B 4F 5D 92 58 B6 9E E7 F0 91 After xor: C5 BF 4B 15 30 D1 95 40 4D 83 4A A5 8A F2 E6 86 [msg] After AES: 9C 38 40 5E A0 3C 1B C9 04 B5 8B 40 C7 6C A2 EB After xor: 84 21 5A 45 BC 21 05 C9 04 B5 8B 40 C7 6C A2 EB [msg] After AES: 2D C6 97 E4 11 CA 83 A8 60 C2 C4 06 CC AA 54 2F CBC-MAC : 2D C6 97 E4 11 CA 83 A8 CTR Start: 01 00 00 00 03 02 01 00 A0 A1 A2 A3 A4 A5 00 01 CTR[0001]: 50 85 9D 91 6D CB 6D DD E0 77 C2 D1 D4 EC 9F 97 CTR[0002]: 75 46 71 7A C6 DE 9A FF 64 0C 9C 06 DE 6D 0D 8F CTR[MAC ]: 3A 2E 46 C8 EC 33 A5 48 Total packet length = 39. [Authenticated and Encrypted Output] 00 01 02 03 04 05 06 07 58 8C 97 9A 61 C6 63 D2 F0 66 D0 C2 C0 F9 89 80 6D 5F 6B 61 DA C3 84 17 E8 D1 2C FD F9 26 E0
=============== Packet Vector #2 ================== AES Key = C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF Nonce = 00 00 00 04 03 02 01 A0 A1 A2 A3 A4 A5 Total packet length = 32. [Input with 8 cleartext header octets] 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F CBC IV in: 59 00 00 00 04 03 02 01 A0 A1 A2 A3 A4 A5 00 18 CBC IV out:F0 C2 54 D3 CA 03 E2 39 70 BD 24 A8 4C 39 9E 77 After xor: F0 CA 54 D2 C8 00 E6 3C 76 BA 24 A8 4C 39 9E 77 [hdr] After AES: 48 DE 8B 86 28 EA 4A 40 00 AA 42 C2 95 BF 4A 8C After xor: 40 D7 81 8D 24 E7 44 4F 10 BB 50 D1 81 AA 5C 9B [msg] After AES: 0F 89 FF BC A6 2B C2 4F 13 21 5F 16 87 96 AA 33 After xor: 17 90 E5 A7 BA 36 DC 50 13 21 5F 16 87 96 AA 33 [msg] After AES: F7 B9 05 6A 86 92 6C F3 FB 16 3D C4 99 EF AA 11 CBC-MAC : F7 B9 05 6A 86 92 6C F3 CTR Start: 01 00 00 00 04 03 02 01 A0 A1 A2 A3 A4 A5 00 01 CTR[0001]: 7A C0 10 3D ED 38 F6 C0 39 0D BA 87 1C 49 91 F4 CTR[0002]: D4 0C DE 22 D5 F9 24 24 F7 BE 9A 56 9D A7 9F 51 CTR[MAC ]: 57 28 D0 04 96 D2 65 E5 Total packet length = 40. [Authenticated and Encrypted Output] 00 01 02 03 04 05 06 07 72 C9 1A 36 E1 35 F8 CF 29 1C A8 94 08 5C 87 E3 CC 15 C4 39 C9 E4 3A 3B A0 91 D5 6E 10 40 09 16
Whiting, et al. Informational [Page 11]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
=============== Packet Vector #3 ================== AES Key = C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF Nonce = 00 00 00 05 04 03 02 A0 A1 A2 A3 A4 A5 Total packet length = 33. [Input with 8 cleartext header octets] 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 CBC IV in: 59 00 00 00 05 04 03 02 A0 A1 A2 A3 A4 A5 00 19 CBC IV out:6F 8A 12 F7 BF 8D 4D C5 A1 19 6E 95 DF F0 B4 27 After xor: 6F 82 12 F6 BD 8E 49 C0 A7 1E 6E 95 DF F0 B4 27 [hdr] After AES: 37 E9 B7 8C C2 20 17 E7 33 80 43 0C BE F4 28 24 After xor: 3F E0 BD 87 CE 2D 19 E8 23 91 51 1F AA E1 3E 33 [msg] After AES: 90 CA 05 13 9F 4D 4E CF 22 6F E9 81 C5 9E 2D 40 After xor: 88 D3 1F 08 83 50 50 D0 02 6F E9 81 C5 9E 2D 40 [msg] After AES: 73 B4 67 75 C0 26 DE AA 41 03 97 D6 70 FE 5F B0 CBC-MAC : 73 B4 67 75 C0 26 DE AA CTR Start: 01 00 00 00 05 04 03 02 A0 A1 A2 A3 A4 A5 00 01 CTR[0001]: 59 B8 EF FF 46 14 73 12 B4 7A 1D 9D 39 3D 3C FF CTR[0002]: 69 F1 22 A0 78 C7 9B 89 77 89 4C 99 97 5C 23 78 CTR[MAC ]: 39 6E C0 1A 7D B9 6E 6F Total packet length = 41. [Authenticated and Encrypted Output] 00 01 02 03 04 05 06 07 51 B1 E5 F4 4A 19 7D 1D A4 6B 0F 8E 2D 28 2A E8 71 E8 38 BB 64 DA 85 96 57 4A DA A7 6F BD 9F B0 C5
=============== Packet Vector #4 ================== AES Key = C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF Nonce = 00 00 00 06 05 04 03 A0 A1 A2 A3 A4 A5 Total packet length = 31. [Input with 12 cleartext header octets] 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E CBC IV in: 59 00 00 00 06 05 04 03 A0 A1 A2 A3 A4 A5 00 13 CBC IV out:06 65 2C 60 0E F5 89 63 CA C3 25 A9 CD 3E 2B E1 After xor: 06 69 2C 61 0C F6 8D 66 CC C4 2D A0 C7 35 2B E1 [hdr] After AES: A0 75 09 AC 15 C2 58 86 04 2F 80 60 54 FE A6 86 After xor: AC 78 07 A3 05 D3 4A 95 10 3A 96 77 4C E7 BC 9D [msg] After AES: 64 4C 09 90 D9 1B 83 E9 AB 4B 8E ED 06 6F F5 BF After xor: 78 51 17 90 D9 1B 83 E9 AB 4B 8E ED 06 6F F5 BF [msg] After AES: 4B 4F 4B 39 B5 93 E6 BF B0 B2 C2 B7 0F 29 CD 7A CBC-MAC : 4B 4F 4B 39 B5 93 E6 BF CTR Start: 01 00 00 00 06 05 04 03 A0 A1 A2 A3 A4 A5 00 01 CTR[0001]: AE 81 66 6A 83 8B 88 6A EE BF 4A 5B 32 84 50 8A CTR[0002]: D1 B1 92 06 AC 93 9E 2F B6 DD CE 10 A7 74 FD 8D CTR[MAC ]: DD 87 2A 80 7C 75 F8 4E Total packet length = 39. [Authenticated and Encrypted Output] 00 01 02 03 04 05 06 07 08 09 0A 0B A2 8C 68 65 93 9A 9A 79 FA AA 5C 4C 2A 9D 4A 91 CD AC 8C 96 C8 61 B9 C9 E6 1E F1
Whiting, et al. Informational [Page 12]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
=============== Packet Vector #5 ================== AES Key = C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF Nonce = 00 00 00 07 06 05 04 A0 A1 A2 A3 A4 A5 Total packet length = 32. [Input with 12 cleartext header octets] 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F CBC IV in: 59 00 00 00 07 06 05 04 A0 A1 A2 A3 A4 A5 00 14 CBC IV out:00 4C 50 95 45 80 3C 48 51 CD E1 3B 56 C8 9A 85 After xor: 00 40 50 94 47 83 38 4D 57 CA E9 32 5C C3 9A 85 [hdr] After AES: E2 B8 F7 CE 49 B2 21 72 84 A8 EA 84 FA AD 67 5C After xor: EE B5 F9 C1 59 A3 33 61 90 BD FC 93 E2 B4 7D 47 [msg] After AES: 3E FB 36 72 25 DB 11 01 D3 C2 2F 0E CA FF 44 F3 After xor: 22 E6 28 6D 25 DB 11 01 D3 C2 2F 0E CA FF 44 F3 [msg] After AES: 48 B9 E8 82 55 05 4A B5 49 0A 95 F9 34 9B 4B 5E CBC-MAC : 48 B9 E8 82 55 05 4A B5 CTR Start: 01 00 00 00 07 06 05 04 A0 A1 A2 A3 A4 A5 00 01 CTR[0001]: D0 FC F5 74 4D 8F 31 E8 89 5B 05 05 4B 7C 90 C3 CTR[0002]: 72 A0 D4 21 9F 0D E1 D4 04 83 BC 2D 3D 0C FC 2A CTR[MAC ]: 19 51 D7 85 28 99 67 26 Total packet length = 40. [Authenticated and Encrypted Output] 00 01 02 03 04 05 06 07 08 09 0A 0B DC F1 FB 7B 5D 9E 23 FB 9D 4E 13 12 53 65 8A D8 6E BD CA 3E 51 E8 3F 07 7D 9C 2D 93
=============== Packet Vector #6 ================== AES Key = C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF Nonce = 00 00 00 08 07 06 05 A0 A1 A2 A3 A4 A5 Total packet length = 33. [Input with 12 cleartext header octets] 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 CBC IV in: 59 00 00 00 08 07 06 05 A0 A1 A2 A3 A4 A5 00 15 CBC IV out:04 72 DA 4C 6F F6 0A 63 06 52 1A 06 04 80 CD E5 After xor: 04 7E DA 4D 6D F5 0E 66 00 55 12 0F 0E 8B CD E5 [hdr] After AES: 64 4C 36 A5 A2 27 37 62 0B 89 F1 D7 BF F2 73 D4 After xor: 68 41 38 AA B2 36 25 71 1F 9C E7 C0 A7 EB 69 CF [msg] After AES: 41 E1 19 CD 19 24 CE 77 F1 2F A6 60 C1 6E BB 4E After xor: 5D FC 07 D2 39 24 CE 77 F1 2F A6 60 C1 6E BB 4E [msg] After AES: A5 27 D8 15 6A C3 59 BF 1C B8 86 E6 2F 29 91 29 CBC-MAC : A5 27 D8 15 6A C3 59 BF CTR Start: 01 00 00 00 08 07 06 05 A0 A1 A2 A3 A4 A5 00 01 CTR[0001]: 63 CC BE 1E E0 17 44 98 45 64 B2 3A 8D 24 5C 80 CTR[0002]: 39 6D BA A2 A7 D2 CB D4 B5 E1 7C 10 79 45 BB C0 CTR[MAC ]: E5 7D DC 56 C6 52 92 2B Total packet length = 41. [Authenticated and Encrypted Output] 00 01 02 03 04 05 06 07 08 09 0A 0B 6F C1 B0 11 F0 06 56 8B 51 71 A4 2D 95 3D 46 9B 25 70 A4 BD 87 40 5A 04 43 AC 91 CB 94
Whiting, et al. Informational [Page 13]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
=============== Packet Vector #7 ================== AES Key = C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF Nonce = 00 00 00 09 08 07 06 A0 A1 A2 A3 A4 A5 Total packet length = 31. [Input with 8 cleartext header octets] 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E CBC IV in: 61 00 00 00 09 08 07 06 A0 A1 A2 A3 A4 A5 00 17 CBC IV out:60 06 C5 72 DA 23 9C BF A0 5B 0A DE D2 CD A8 1E After xor: 60 0E C5 73 D8 20 98 BA A6 5C 0A DE D2 CD A8 1E [hdr] After AES: 41 7D E2 AE 94 E2 EA D9 00 FC 44 FC D0 69 52 27 After xor: 49 74 E8 A5 98 EF E4 D6 10 ED 56 EF C4 7C 44 30 [msg] After AES: 2A 6C 42 CA 49 D7 C7 01 C5 7D 59 FF 87 16 49 0E After xor: 32 75 58 D1 55 CA D9 01 C5 7D 59 FF 87 16 49 0E [msg] After AES: 89 8B D6 45 4E 27 20 BB D2 7E F3 15 7A 7C 90 B2 CBC-MAC : 89 8B D6 45 4E 27 20 BB D2 7E CTR Start: 01 00 00 00 09 08 07 06 A0 A1 A2 A3 A4 A5 00 01 CTR[0001]: 09 3C DB B9 C5 52 4F DA C1 C5 EC D2 91 C4 70 AF CTR[0002]: 11 57 83 86 E2 C4 72 B4 8E CC 8A AD AB 77 6F CB CTR[MAC ]: 8D 07 80 25 62 B0 8C 00 A6 EE Total packet length = 41. [Authenticated and Encrypted Output] 00 01 02 03 04 05 06 07 01 35 D1 B2 C9 5F 41 D5 D1 D4 FE C1 85 D1 66 B8 09 4E 99 9D FE D9 6C 04 8C 56 60 2C 97 AC BB 74 90
=============== Packet Vector #8 ================== AES Key = C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF Nonce = 00 00 00 0A 09 08 07 A0 A1 A2 A3 A4 A5 Total packet length = 32. [Input with 8 cleartext header octets] 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F CBC IV in: 61 00 00 00 0A 09 08 07 A0 A1 A2 A3 A4 A5 00 18 CBC IV out:63 A3 FA E4 6C 79 F3 FA 78 38 B8 A2 80 36 B6 0B After xor: 63 AB FA E5 6E 7A F7 FF 7E 3F B8 A2 80 36 B6 0B [hdr] After AES: 1C 99 1A 3D B7 60 79 27 34 40 79 1F AD 8B 5B 02 After xor: 14 90 10 36 BB 6D 77 28 24 51 6B 0C B9 9E 4D 15 [msg] After AES: 14 19 E8 E8 CB BE 75 58 E1 E3 BE 4B 6C 9F 82 E3 After xor: 0C 00 F2 F3 D7 A3 6B 47 E1 E3 BE 4B 6C 9F 82 E3 [msg] After AES: E0 16 E8 1C 7F 7B 8A 38 A5 38 F2 CB 5B B6 C1 F2 CBC-MAC : E0 16 E8 1C 7F 7B 8A 38 A5 38 CTR Start: 01 00 00 00 0A 09 08 07 A0 A1 A2 A3 A4 A5 00 01 CTR[0001]: 73 7C 33 91 CC 8E 13 DD E0 AA C5 4B 6D B7 EB 98 CTR[0002]: 74 B7 71 77 C5 AA C5 3B 04 A4 F8 70 8E 92 EB 2B CTR[MAC ]: 21 6D AC 2F 8B 4F 1C 07 91 8C Total packet length = 42. [Authenticated and Encrypted Output] 00 01 02 03 04 05 06 07 7B 75 39 9A C0 83 1D D2 F0 BB D7 58 79 A2 FD 8F 6C AE 6B 6C D9 B7 DB 24 C1 7B 44 33 F4 34 96 3F 34 B4
Whiting, et al. Informational [Page 14]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
=============== Packet Vector #9 ================== AES Key = C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF Nonce = 00 00 00 0B 0A 09 08 A0 A1 A2 A3 A4 A5 Total packet length = 33. [Input with 8 cleartext header octets] 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 CBC IV in: 61 00 00 00 0B 0A 09 08 A0 A1 A2 A3 A4 A5 00 19 CBC IV out:4F 2C 86 11 1E 08 2A DD 6B 44 21 3A B5 13 13 16 After xor: 4F 24 86 10 1C 0B 2E D8 6D 43 21 3A B5 13 13 16 [hdr] After AES: F6 EC 56 87 3C 57 12 DC 9C C5 3C A8 D4 D1 ED 0A After xor: FE E5 5C 8C 30 5A 1C D3 8C D4 2E BB C0 C4 FB 1D [msg] After AES: 17 C1 80 A5 31 53 D4 C3 03 85 0C 95 65 80 34 52 After xor: 0F D8 9A BE 2D 4E CA DC 23 85 0C 95 65 80 34 52 [msg] After AES: 46 A1 F6 E2 B1 6E 75 F8 1C F5 6B 1A 80 04 44 1B CBC-MAC : 46 A1 F6 E2 B1 6E 75 F8 1C F5 CTR Start: 01 00 00 00 0B 0A 09 08 A0 A1 A2 A3 A4 A5 00 01 CTR[0001]: 8A 5A 10 6B C0 29 9A 55 5B 93 6B 0B 0E A0 DE 5A CTR[0002]: EA 05 FD E2 AB 22 5C FE B7 73 12 CB 88 D9 A5 4A CTR[MAC ]: AC 3D F1 07 DA 30 C4 86 43 BB Total packet length = 43. [Authenticated and Encrypted Output] 00 01 02 03 04 05 06 07 82 53 1A 60 CC 24 94 5A 4B 82 79 18 1A B5 C8 4D F2 1C E7 F9 B7 3F 42 E1 97 EA 9C 07 E5 6B 5E B1 7E 5F 4E
=============== Packet Vector #10 ================== AES Key = C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF Nonce = 00 00 00 0C 0B 0A 09 A0 A1 A2 A3 A4 A5 Total packet length = 31. [Input with 12 cleartext header octets] 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E CBC IV in: 61 00 00 00 0C 0B 0A 09 A0 A1 A2 A3 A4 A5 00 13 CBC IV out:7F B8 0A 32 E9 80 57 46 EC 31 6C 3A B2 A2 EB 5D After xor: 7F B4 0A 33 EB 83 53 43 EA 36 64 33 B8 A9 EB 5D [hdr] After AES: 7E 96 96 BF F1 56 D6 A8 6E AC F5 7B 7F 23 47 5A After xor: 72 9B 98 B0 E1 47 C4 BB 7A B9 E3 6C 67 3A 5D 41 [msg] After AES: 8B 4A EE 42 04 24 8A 59 FA CC 88 66 57 66 DD 72 After xor: 97 57 F0 42 04 24 8A 59 FA CC 88 66 57 66 DD 72 [msg] After AES: 41 63 89 36 62 ED D7 EB CD 6E 15 C1 89 48 62 05 CBC-MAC : 41 63 89 36 62 ED D7 EB CD 6E CTR Start: 01 00 00 00 0C 0B 0A 09 A0 A1 A2 A3 A4 A5 00 01 CTR[0001]: 0B 39 2B 9B 05 66 97 06 3F 12 56 8F 2B 13 A1 0F CTR[0002]: 07 89 65 25 23 40 94 3B 9E 69 B2 56 CC 5E F7 31 CTR[MAC ]: 17 09 20 76 09 A0 4E 72 45 B3 Total packet length = 41. [Authenticated and Encrypted Output] 00 01 02 03 04 05 06 07 08 09 0A 0B 07 34 25 94 15 77 85 15 2B 07 40 98 33 0A BB 14 1B 94 7B 56 6A A9 40 6B 4D 99 99 88 DD
Whiting, et al. Informational [Page 15]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
=============== Packet Vector #11 ================== AES Key = C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF Nonce = 00 00 00 0D 0C 0B 0A A0 A1 A2 A3 A4 A5 Total packet length = 32. [Input with 12 cleartext header octets] 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F CBC IV in: 61 00 00 00 0D 0C 0B 0A A0 A1 A2 A3 A4 A5 00 14 CBC IV out:B0 84 85 79 51 D2 FA 42 76 EF 3A D7 14 B9 62 87 After xor: B0 88 85 78 53 D1 FE 47 70 E8 32 DE 1E B2 62 87 [hdr] After AES: C9 B3 64 7E D8 79 2A 5C 65 B7 CE CC 19 0A 97 0A After xor: C5 BE 6A 71 C8 68 38 4F 71 A2 D8 DB 01 13 8D 11 [msg] After AES: 34 0F 69 17 FA B9 19 D6 1D AC D0 35 36 D6 55 8B After xor: 28 12 77 08 FA B9 19 D6 1D AC D0 35 36 D6 55 8B [msg] After AES: 6B 5E 24 34 12 CC C2 AD 6F 1B 11 C3 A1 A9 D8 BC CBC-MAC : 6B 5E 24 34 12 CC C2 AD 6F 1B CTR Start: 01 00 00 00 0D 0C 0B 0A A0 A1 A2 A3 A4 A5 00 01 CTR[0001]: 6B 66 BC 0C 90 A1 F1 12 FC BE 6F 4E 12 20 77 BC CTR[0002]: 97 9E 57 2B BE 65 8A E5 CC 20 11 83 2A 9A 9B 5B CTR[MAC ]: 9E 64 86 DD 02 B6 49 C1 6D 37 Total packet length = 42. [Authenticated and Encrypted Output] 00 01 02 03 04 05 06 07 08 09 0A 0B 67 6B B2 03 80 B0 E3 01 E8 AB 79 59 0A 39 6D A7 8B 83 49 34 F5 3A A2 E9 10 7A 8B 6C 02 2C
=============== Packet Vector #12 ================== AES Key = C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF Nonce = 00 00 00 0E 0D 0C 0B A0 A1 A2 A3 A4 A5 Total packet length = 33. [Input with 12 cleartext header octets] 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 CBC IV in: 61 00 00 00 0E 0D 0C 0B A0 A1 A2 A3 A4 A5 00 15 CBC IV out:5F 8E 8D 02 AD 95 7C 5A 36 14 CF 63 40 16 97 4F After xor: 5F 82 8D 03 AF 96 78 5F 30 13 C7 6A 4A 1D 97 4F [hdr] After AES: 63 FA BD 69 B9 55 65 FF 54 AA F4 60 88 7D EC 9F After xor: 6F F7 B3 66 A9 44 77 EC 40 BF E2 77 90 64 F6 84 [msg] After AES: 5A 76 5F 0B 93 CE 4F 6A B4 1D 91 30 18 57 6A D7 After xor: 46 6B 41 14 B3 CE 4F 6A B4 1D 91 30 18 57 6A D7 [msg] After AES: 9D 66 92 41 01 08 D5 B6 A1 45 85 AC AF 86 32 E8 CBC-MAC : 9D 66 92 41 01 08 D5 B6 A1 45 CTR Start: 01 00 00 00 0E 0D 0C 0B A0 A1 A2 A3 A4 A5 00 01 CTR[0001]: CC F2 AE D9 E0 4A C9 74 E6 58 55 B3 2B 94 30 BF CTR[0002]: A2 CA AC 11 63 F4 07 E5 E5 F6 E3 B3 79 0F 79 F8 CTR[MAC ]: 50 7C 31 57 63 EF 78 D3 77 9E Total packet length = 43. [Authenticated and Encrypted Output] 00 01 02 03 04 05 06 07 08 09 0A 0B C0 FF A0 D6 F0 5B DB 67 F2 4D 43 A4 33 8D 2A A4 BE D7 B2 0E 43 CD 1A A3 16 62 E7 AD 65 D6 DB
Whiting, et al. Informational [Page 16]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
=============== Packet Vector #13 ================== AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B Nonce = 00 41 2B 4E A9 CD BE 3C 96 96 76 6C FA Total packet length = 31. [Input with 8 cleartext header octets] 0B E1 A8 8B AC E0 18 B1 08 E8 CF 97 D8 20 EA 25 84 60 E9 6A D9 CF 52 89 05 4D 89 5C EA C4 7C CBC IV in: 59 00 41 2B 4E A9 CD BE 3C 96 96 76 6C FA 00 17 CBC IV out:33 AE C3 1A 1F B7 CC 35 E5 DA D2 BA C0 90 D9 A3 After xor: 33 A6 C8 FB B7 3C 60 D5 FD 6B D2 BA C0 90 D9 A3 [hdr] After AES: B7 56 CA 1E 5B 42 C6 9C 58 E3 0A F5 2B F7 7C FD After xor: BF BE 05 89 83 62 2C B9 DC 83 E3 9F F2 38 2E 74 [msg] After AES: 33 3D 3A 3D 07 B5 3C 7B 22 0E 96 1A 18 A9 A1 9E After xor: 36 70 B3 61 ED 71 40 7B 22 0E 96 1A 18 A9 A1 9E [msg] After AES: 14 BD DB 6B F9 01 63 4D FB 56 51 83 BC 74 93 F7 CBC-MAC : 14 BD DB 6B F9 01 63 4D CTR Start: 01 00 41 2B 4E A9 CD BE 3C 96 96 76 6C FA 00 01 CTR[0001]: 44 51 B0 11 7A 84 82 BF 03 19 AE C1 59 5E BD DA CTR[0002]: 83 EB 76 E1 3A 44 84 7F 92 20 09 07 76 B8 25 C5 CTR[MAC ]: F3 31 2C A0 F5 DC B4 FE Total packet length = 39. [Authenticated and Encrypted Output] 0B E1 A8 8B AC E0 18 B1 4C B9 7F 86 A2 A4 68 9A 87 79 47 AB 80 91 EF 53 86 A6 FF BD D0 80 F8 E7 8C F7 CB 0C DD D7 B3
=============== Packet Vector #14 ================== AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B Nonce = 00 33 56 8E F7 B2 63 3C 96 96 76 6C FA Total packet length = 32. [Input with 8 cleartext header octets] 63 01 8F 76 DC 8A 1B CB 90 20 EA 6F 91 BD D8 5A FA 00 39 BA 4B AF F9 BF B7 9C 70 28 94 9C D0 EC CBC IV in: 59 00 33 56 8E F7 B2 63 3C 96 96 76 6C FA 00 18 CBC IV out:42 0D B1 50 BB 0C 44 DA 83 E4 52 09 55 99 67 E3 After xor: 42 05 D2 51 34 7A 98 50 98 2F 52 09 55 99 67 E3 [hdr] After AES: EA D1 CA 56 02 02 09 5C E6 12 B0 D2 18 A0 DD 44 After xor: 7A F1 20 39 93 BF D1 06 1C 12 89 68 53 0F 24 FB [msg] After AES: 51 77 41 69 C3 DE 6B 24 13 27 74 90 F5 FF C5 62 After xor: E6 EB 31 41 57 42 BB C8 13 27 74 90 F5 FF C5 62 [msg] After AES: D4 CC 3B 82 DF 9F CC 56 7E E5 83 61 D7 8D FB 5E CBC-MAC : D4 CC 3B 82 DF 9F CC 56 CTR Start: 01 00 33 56 8E F7 B2 63 3C 96 96 76 6C FA 00 01 CTR[0001]: DC EB F4 13 38 3C 66 A0 5A 72 55 EF 98 D7 FF AD CTR[0002]: 2F 54 2C BA 15 D6 6C DF E1 EC 46 8F 0E 68 A1 24 CTR[MAC ]: 11 E2 D3 9F A2 E8 0C DC Total packet length = 40. [Authenticated and Encrypted Output] 63 01 8F 76 DC 8A 1B CB 4C CB 1E 7C A9 81 BE FA A0 72 6C 55 D3 78 06 12 98 C8 5C 92 81 4A BC 33 C5 2E E8 1D 7D 77 C0 8A
Whiting, et al. Informational [Page 17]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
=============== Packet Vector #15 ================== AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B Nonce = 00 10 3F E4 13 36 71 3C 96 96 76 6C FA Total packet length = 33. [Input with 8 cleartext header octets] AA 6C FA 36 CA E8 6B 40 B9 16 E0 EA CC 1C 00 D7 DC EC 68 EC 0B 3B BB 1A 02 DE 8A 2D 1A A3 46 13 2E CBC IV in: 59 00 10 3F E4 13 36 71 3C 96 96 76 6C FA 00 19 CBC IV out:B3 26 49 FF D5 9F 56 0F 02 2D 11 E2 62 C5 BE EA After xor: B3 2E E3 93 2F A9 9C E7 69 6D 11 E2 62 C5 BE EA [hdr] After AES: 82 50 9E E5 B2 FF DB CA 9B D0 2E 20 6B 3F B7 AD After xor: 3B 46 7E 0F 7E E3 DB 1D 47 3C 46 CC 60 04 0C B7 [msg] After AES: 80 46 0E 4C 08 3A D0 3F B9 A9 13 BE E4 DE 2F 66 After xor: 82 98 84 61 12 99 96 2C 97 A9 13 BE E4 DE 2F 66 [msg] After AES: 47 29 CB 00 31 F1 81 C1 92 68 4B 89 A4 71 50 E7 CBC-MAC : 47 29 CB 00 31 F1 81 C1 CTR Start: 01 00 10 3F E4 13 36 71 3C 96 96 76 6C FA 00 01 CTR[0001]: 08 C4 DA C8 EC C1 C0 7B 4C E1 F2 4C 37 5A 47 EE CTR[0002]: A7 87 2E 6C 6D C4 4E 84 26 02 50 4C 3F A5 73 C5 CTR[MAC ]: E0 5F B2 6E EA 83 B4 C7 Total packet length = 41. [Authenticated and Encrypted Output] AA 6C FA 36 CA E8 6B 40 B1 D2 3A 22 20 DD C0 AC 90 0D 9A A0 3C 61 FC F4 A5 59 A4 41 77 67 08 97 08 A7 76 79 6E DB 72 35 06
=============== Packet Vector #16 ================== AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B Nonce = 00 76 4C 63 B8 05 8E 3C 96 96 76 6C FA Total packet length = 31. [Input with 12 cleartext header octets] D0 D0 73 5C 53 1E 1B EC F0 49 C2 44 12 DA AC 56 30 EF A5 39 6F 77 0C E1 A6 6B 21 F7 B2 10 1C CBC IV in: 59 00 76 4C 63 B8 05 8E 3C 96 96 76 6C FA 00 13 CBC IV out:AB DC 4E C9 AA 72 33 97 DF 2D AD 76 33 DE 3B 0D After xor: AB D0 9E 19 D9 2E 60 89 C4 C1 5D 3F F1 9A 3B 0D [hdr] After AES: 62 86 F6 2F 23 42 63 B0 1C FD 8C 37 40 74 81 EB After xor: 70 5C 5A 79 13 AD C6 89 73 8A 80 D6 E6 1F A0 1C [msg] After AES: 88 95 84 18 CF 79 CA BE EB C0 0C C4 86 E6 01 F7 After xor: 3A 85 98 18 CF 79 CA BE EB C0 0C C4 86 E6 01 F7 [msg] After AES: C1 85 92 D9 84 CD 67 80 63 D1 D9 6D C1 DF A1 11 CBC-MAC : C1 85 92 D9 84 CD 67 80 CTR Start: 01 00 76 4C 63 B8 05 8E 3C 96 96 76 6C FA 00 01 CTR[0001]: 06 08 FF 95 A6 94 D5 59 F4 0B B7 9D EF FA 41 DF CTR[0002]: 80 55 3A 75 78 38 04 A9 64 8B 68 DD 7F DC DD 7A CTR[MAC ]: 5B EA DB 4E DF 07 B9 2F Total packet length = 39. [Authenticated and Encrypted Output] D0 D0 73 5C 53 1E 1B EC F0 49 C2 44 14 D2 53 C3 96 7B 70 60 9B 7C BB 7C 49 91 60 28 32 45 26 9A 6F 49 97 5B CA DE AF
Whiting, et al. Informational [Page 18]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
=============== Packet Vector #17 ================== AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B Nonce = 00 F8 B6 78 09 4E 3B 3C 96 96 76 6C FA Total packet length = 32. [Input with 12 cleartext header octets] 77 B6 0F 01 1C 03 E1 52 58 99 BC AE E8 8B 6A 46 C7 8D 63 E5 2E B8 C5 46 EF B5 DE 6F 75 E9 CC 0D CBC IV in: 59 00 F8 B6 78 09 4E 3B 3C 96 96 76 6C FA 00 14 CBC IV out:F4 68 FE 5D B1 53 0B 7A 5A A5 FB 27 40 CF 6E 33 After xor: F4 64 89 EB BE 52 17 79 BB F7 A3 BE FC 61 6E 33 [hdr] After AES: 23 29 0E 0B 33 45 9A 83 32 2D E4 06 86 67 10 04 After xor: CB A2 64 4D F4 C8 F9 66 1C 95 21 40 69 D2 CE 6B [msg] After AES: 8F BE D4 0F 8B 89 B7 B8 20 D5 5F E0 3C E2 43 11 After xor: FA 57 18 02 8B 89 B7 B8 20 D5 5F E0 3C E2 43 11 [msg] After AES: 6A DB 15 B6 71 81 B2 E2 2B E3 4A F2 B2 83 E2 29 CBC-MAC : 6A DB 15 B6 71 81 B2 E2 CTR Start: 01 00 F8 B6 78 09 4E 3B 3C 96 96 76 6C FA 00 01 CTR[0001]: BD CE 95 5C CF D3 81 0A 91 EA 77 A6 A4 5B C0 4C CTR[0002]: 43 2E F2 32 AE 36 D8 92 22 BF 63 37 E6 B2 6C E8 CTR[MAC ]: 1C F7 19 C1 35 7F CC DE Total packet length = 40. [Authenticated and Encrypted Output] 77 B6 0F 01 1C 03 E1 52 58 99 BC AE 55 45 FF 1A 08 5E E2 EF BF 52 B2 E0 4B EE 1E 23 36 C7 3E 3F 76 2C 0C 77 44 FE 7E 3C
=============== Packet Vector #18 ================== AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B Nonce = 00 D5 60 91 2D 3F 70 3C 96 96 76 6C FA Total packet length = 33. [Input with 12 cleartext header octets] CD 90 44 D2 B7 1F DB 81 20 EA 60 C0 64 35 AC BA FB 11 A8 2E 2F 07 1D 7C A4 A5 EB D9 3A 80 3B A8 7F CBC IV in: 59 00 D5 60 91 2D 3F 70 3C 96 96 76 6C FA 00 15 CBC IV out:BA 37 74 54 D7 20 A4 59 25 97 F6 A3 D1 D6 BA 67 After xor: BA 3B B9 C4 93 F2 13 46 FE 16 D6 49 B1 16 BA 67 [hdr] After AES: 81 6A 20 20 38 D0 A6 30 CB E0 B7 3C 39 BB CE 05 After xor: E5 5F 8C 9A C3 C1 0E 1E E4 E7 AA 40 9D 1E 25 DC [msg] After AES: 6D 5C 15 FD 85 2D 5C 3C E3 03 3D 85 DA 57 BD AC After xor: 57 DC 2E 55 FA 2D 5C 3C E3 03 3D 85 DA 57 BD AC [msg] After AES: B0 4A 1C 23 BC 39 B6 51 76 FD 5B FF 9B C1 28 5E CBC-MAC : B0 4A 1C 23 BC 39 B6 51 CTR Start: 01 00 D5 60 91 2D 3F 70 3C 96 96 76 6C FA 00 01 CTR[0001]: 64 A2 C5 56 50 CE E0 4C 7A 93 D8 EE F5 43 E8 8E CTR[0002]: 18 E7 65 AC B7 B0 E9 AF 09 2B D0 20 6C A1 C8 3C CTR[MAC ]: F7 43 82 79 5C 49 F3 00 Total packet length = 41. [Authenticated and Encrypted Output] CD 90 44 D2 B7 1F DB 81 20 EA 60 C0 00 97 69 EC AB DF 48 62 55 94 C5 92 51 E6 03 57 22 67 5E 04 C8 47 09 9E 5A E0 70 45 51
Whiting, et al. Informational [Page 19]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
=============== Packet Vector #19 ================== AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B Nonce = 00 42 FF F8 F1 95 1C 3C 96 96 76 6C FA Total packet length = 31. [Input with 8 cleartext header octets] D8 5B C7 E6 9F 94 4F B8 8A 19 B9 50 BC F7 1A 01 8E 5E 67 01 C9 17 87 65 98 09 D6 7D BE DD 18 CBC IV in: 61 00 42 FF F8 F1 95 1C 3C 96 96 76 6C FA 00 17 CBC IV out:44 F7 CC 9C 2B DD 2F 45 F6 38 25 6B 73 6E 1D 7A After xor: 44 FF 14 C7 EC 3B B0 D1 B9 80 25 6B 73 6E 1D 7A [hdr] After AES: 57 C3 73 F8 00 AA 5F CC 7B CF 1D 1B DD BB 4C 52 After xor: DD DA CA A8 BC 5D 45 CD F5 91 7A 1A 14 AC CB 37 [msg] After AES: 42 4E 93 72 72 C8 79 B6 11 C7 A5 9F 47 8D 9F D8 After xor: DA 47 45 0F CC 15 61 B6 11 C7 A5 9F 47 8D 9F D8 [msg] After AES: 9A CB 03 F8 B9 DB C8 D2 D2 D7 A4 B4 95 25 08 67 CBC-MAC : 9A CB 03 F8 B9 DB C8 D2 D2 D7 CTR Start: 01 00 42 FF F8 F1 95 1C 3C 96 96 76 6C FA 00 01 CTR[0001]: 36 38 34 FA 28 83 3D B7 55 66 0D 98 65 0D 68 46 CTR[0002]: 35 E9 63 54 87 16 72 56 3F 0C 08 AF 78 44 31 A9 CTR[MAC ]: F9 B7 FA 46 7B 9B 40 45 14 6D Total packet length = 41. [Authenticated and Encrypted Output] D8 5B C7 E6 9F 94 4F B8 BC 21 8D AA 94 74 27 B6 DB 38 6A 99 AC 1A EF 23 AD E0 B5 29 39 CB 6A 63 7C F9 BE C2 40 88 97 C6 BA
=============== Packet Vector #20 ================== AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B Nonce = 00 92 0F 40 E5 6C DC 3C 96 96 76 6C FA Total packet length = 32. [Input with 8 cleartext header octets] 74 A0 EB C9 06 9F 5B 37 17 61 43 3C 37 C5 A3 5F C1 F3 9F 40 63 02 EB 90 7C 61 63 BE 38 C9 84 37 CBC IV in: 61 00 92 0F 40 E5 6C DC 3C 96 96 76 6C FA 00 18 CBC IV out:60 CB 21 CE 40 06 50 AE 2A D2 BE 52 9F 5F 0F C2 After xor: 60 C3 55 6E AB CF 56 31 71 E5 BE 52 9F 5F 0F C2 [hdr] After AES: 03 20 64 14 35 32 5D 95 C8 A2 50 40 93 28 DA 9B After xor: 14 41 27 28 02 F7 FE CA 09 51 CF 00 F0 2A 31 0B [msg] After AES: B9 E8 87 95 ED F7 F0 08 15 15 F0 14 E2 FE 0E 48 After xor: C5 89 E4 2B D5 3E 74 3F 15 15 F0 14 E2 FE 0E 48 [msg] After AES: 8F AD 0C 23 E9 63 7E 87 FA 21 45 51 1B 47 DE F1 CBC-MAC : 8F AD 0C 23 E9 63 7E 87 FA 21 CTR Start: 01 00 92 0F 40 E5 6C DC 3C 96 96 76 6C FA 00 01 CTR[0001]: 4F 71 A5 C1 12 42 E3 7D 29 F0 FE E4 1B E1 02 5F CTR[0002]: 34 2B D3 F1 7C B7 7B C1 79 0B 05 05 61 59 27 2C CTR[MAC ]: 7F 09 7B EF C6 AA C1 D3 73 65 Total packet length = 42. [Authenticated and Encrypted Output] 74 A0 EB C9 06 9F 5B 37 58 10 E6 FD 25 87 40 22 E8 03 61 A4 78 E3 E9 CF 48 4A B0 4F 44 7E FF F6 F0 A4 77 CC 2F C9 BF 54 89 44
Whiting, et al. Informational [Page 20]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
=============== Packet Vector #21 ================== AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B Nonce = 00 27 CA 0C 71 20 BC 3C 96 96 76 6C FA Total packet length = 33. [Input with 8 cleartext header octets] 44 A3 AA 3A AE 64 75 CA A4 34 A8 E5 85 00 C6 E4 15 30 53 88 62 D6 86 EA 9E 81 30 1B 5A E4 22 6B FA CBC IV in: 61 00 27 CA 0C 71 20 BC 3C 96 96 76 6C FA 00 19 CBC IV out:43 07 C0 73 A8 9E E1 D5 05 27 B2 9A 62 48 D6 D2 After xor: 43 0F 84 D0 02 A4 4F B1 70 ED B2 9A 62 48 D6 D2 [hdr] After AES: B6 0B C6 F5 84 01 75 BC 01 27 70 F1 11 8D 75 10 After xor: 12 3F 6E 10 01 01 B3 58 14 17 23 79 73 5B F3 FA [msg] After AES: 7D 5E 64 92 CE 2C B9 EA 7E 4C 4A 09 09 89 C8 FB After xor: E3 DF 54 89 94 C8 9B 81 84 4C 4A 09 09 89 C8 FB [msg] After AES: 68 5F 8D 79 D2 2B 9B 74 21 DF 4C 3E 87 BA 0A AF CBC-MAC : 68 5F 8D 79 D2 2B 9B 74 21 DF CTR Start: 01 00 27 CA 0C 71 20 BC 3C 96 96 76 6C FA 00 01 CTR[0001]: 56 8A 45 9E 40 09 48 67 EB 85 E0 9E 6A 2E 64 76 CTR[0002]: A6 00 AA 92 92 03 54 9A AE EF 2C CC 59 13 7A 57 CTR[MAC ]: 25 1E DC DD 3F 11 10 F3 98 11 Total packet length = 43. [Authenticated and Encrypted Output] 44 A3 AA 3A AE 64 75 CA F2 BE ED 7B C5 09 8E 83 FE B5 B3 16 08 F8 E2 9C 38 81 9A 89 C8 E7 76 F1 54 4D 41 51 A4 ED 3A 8B 87 B9 CE
=============== Packet Vector #22 ================== AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B Nonce = 00 5B 8C CB CD 9A F8 3C 96 96 76 6C FA Total packet length = 31. [Input with 12 cleartext header octets] EC 46 BB 63 B0 25 20 C3 3C 49 FD 70 B9 6B 49 E2 1D 62 17 41 63 28 75 DB 7F 6C 92 43 D2 D7 C2 CBC IV in: 61 00 5B 8C CB CD 9A F8 3C 96 96 76 6C FA 00 13 CBC IV out:91 14 AD 06 B6 CC 02 35 76 9A B6 14 C4 82 95 03 After xor: 91 18 41 40 0D AF B2 10 56 59 8A 5D 39 F2 95 03 [hdr] After AES: 29 BD 7C 27 83 E3 E8 D3 C3 5C 01 F4 4C EC BB FA After xor: 90 D6 35 C5 9E 81 FF 92 A0 74 74 2F 33 80 29 B9 [msg] After AES: 4E DA F4 0D 21 0B D4 5F FE 97 90 B9 AA EC 34 4C After xor: 9C 0D 36 0D 21 0B D4 5F FE 97 90 B9 AA EC 34 4C [msg] After AES: 21 9E F8 90 EA 64 C2 11 A5 37 88 83 E1 BA 22 0D CBC-MAC : 21 9E F8 90 EA 64 C2 11 A5 37 CTR Start: 01 00 5B 8C CB CD 9A F8 3C 96 96 76 6C FA 00 01 CTR[0001]: 88 BC 19 42 80 C1 FA 3E BE FC EF FB 4D C6 2D 54 CTR[0002]: 3E 59 7D A5 AE 21 CC A4 00 9E 4C 0C 91 F6 22 49 CTR[MAC ]: 5C BC 30 98 66 02 A9 F4 64 A0 Total packet length = 41. [Authenticated and Encrypted Output] EC 46 BB 63 B0 25 20 C3 3C 49 FD 70 31 D7 50 A0 9D A3 ED 7F DD D4 9A 20 32 AA BF 17 EC 8E BF 7D 22 C8 08 8C 66 6B E5 C1 97
Whiting, et al. Informational [Page 21]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
=============== Packet Vector #23 ================== AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B Nonce = 00 3E BE 94 04 4B 9A 3C 96 96 76 6C FA Total packet length = 32. [Input with 12 cleartext header octets] 47 A6 5A C7 8B 3D 59 42 27 E8 5E 71 E2 FC FB B8 80 44 2C 73 1B F9 51 67 C8 FF D7 89 5E 33 70 76 CBC IV in: 61 00 3E BE 94 04 4B 9A 3C 96 96 76 6C FA 00 14 CBC IV out:0F 70 3F 5A 54 2C 44 6E 8B 74 A3 73 9B 48 B9 61 After xor: 0F 7C 78 FC 0E EB CF 53 D2 36 84 9B C5 39 B9 61 [hdr] After AES: 40 5B ED 29 D0 98 AE 91 DB 68 78 F3 68 B8 73 85 After xor: A2 A7 16 91 50 DC 82 E2 C0 91 29 94 A0 47 A4 0C [msg] After AES: 3D 03 29 3C FD 81 1B 37 01 51 FB C7 85 6B 7A 74 After xor: 63 30 59 4A FD 81 1B 37 01 51 FB C7 85 6B 7A 74 [msg] After AES: 66 4F 27 16 3E 36 0F 72 62 0D 4E 67 7C E0 61 DE CBC-MAC : 66 4F 27 16 3E 36 0F 72 62 0D CTR Start: 01 00 3E BE 94 04 4B 9A 3C 96 96 76 6C FA 00 01 CTR[0001]: 0A 7E 0A 63 53 C8 CF 9E BC 3B 6E 63 15 9A D0 97 CTR[0002]: EA 20 32 DA 27 82 6E 13 9E 1E 72 5C 5B 0D 3E BF CTR[MAC ]: B9 31 27 CA F0 F1 A1 20 FA 70 Total packet length = 42. [Authenticated and Encrypted Output] 47 A6 5A C7 8B 3D 59 42 27 E8 5E 71 E8 82 F1 DB D3 8C E3 ED A7 C2 3F 04 DD 65 07 1E B4 13 42 AC DF 7E 00 DC CE C7 AE 52 98 7D
=============== Packet Vector #24 ================== AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B Nonce = 00 8D 49 3B 30 AE 8B 3C 96 96 76 6C FA Total packet length = 33. [Input with 12 cleartext header octets] 6E 37 A6 EF 54 6D 95 5D 34 AB 60 59 AB F2 1C 0B 02 FE B8 8F 85 6D F4 A3 73 81 BC E3 CC 12 85 17 D4 CBC IV in: 61 00 8D 49 3B 30 AE 8B 3C 96 96 76 6C FA 00 15 CBC IV out:67 AC E4 E8 06 77 7A D3 27 1D 0B 93 4C 67 98 15 After xor: 67 A0 8A DF A0 98 2E BE B2 40 3F 38 2C 3E 98 15 [hdr] After AES: 35 58 F8 7E CA C2 B4 39 B6 7E 75 BB F1 5E 69 08 After xor: 9E AA E4 75 C8 3C 0C B6 33 13 81 18 82 DF D5 EB [msg] After AES: 54 E4 7B 62 22 F0 BB 87 17 D0 71 6A EB AF 19 9E After xor: 98 F6 FE 75 F6 F0 BB 87 17 D0 71 6A EB AF 19 9E [msg] After AES: 23 E3 30 50 BC 57 DC 2C 3D 3E 7C 94 77 D1 49 71 CBC-MAC : 23 E3 30 50 BC 57 DC 2C 3D 3E CTR Start: 01 00 8D 49 3B 30 AE 8B 3C 96 96 76 6C FA 00 01 CTR[0001]: 58 DB 19 B3 88 9A A3 8B 3C A4 0B 16 FF 42 2C 73 CTR[0002]: C3 2F 24 3D 65 DC 7E 9F 4B 02 16 AB 7F B9 6B 4D CTR[MAC ]: 4E 2D AE D2 53 F6 B1 8A 1D 67 Total packet length = 43. [Authenticated and Encrypted Output] 6E 37 A6 EF 54 6D 95 5D 34 AB 60 59 F3 29 05 B8 8A 64 1B 04 B9 C9 FF B5 8C C3 90 90 0F 3D A1 2A B1 6D CE 9E 82 EF A1 6D A6 20 59
Whiting, et al. Informational [Page 22]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
The authors hereby explicitly release any intellectual property rights to CCM to the public domain. Further, the authors are not aware of any patent or patent application anywhere in the world that covers CCM mode. It is our belief that CCM is a simple combination of well-established techniques, and we believe that CCM is obvious to a person of ordinary skill in the arts.
We claim that this block cipher mode is secure against attackers limited to 2^128 steps of operation if the key K is 256 bits or larger. There are fairly generic precomputation attacks against all block cipher modes that allow a meet-in-the-middle attack on the key K. If these attacks can be made, then the theoretical strength of this, and any other, block cipher mode is limited to 2^(n/2) where n is the number of bits in the key. The strength of the authentication is of course limited by M.
Users of smaller key sizes (such as 128-bits) should take precautions to make the precomputation attacks more difficult. Repeated use of the same nonce value (with different keys of course) ought to be avoided. One solution is to include a random value within the nonce. Of course, a packet counter is also needed within the nonce. Since the nonce is of limited size, a random value in the nonce provides a limited amount of additional security.
[AES] NIST, FIPS PUB 197, "Advanced Encryption Standard (AES)," November 2001.
[CCM] Whiting, D., Housley, R. and N. Ferguson, "AES Encryption & Authentication Using CTR Mode & CBC-MAC," IEEE P802.11 doc 02/001r2, May 2002.
[ESP] Kent, S. and R. Atkinson, "IP Encapsulating Security Payload (ESP)", RFC 2406, November 1998.
Whiting, et al. Informational [Page 23]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
[MAC] NIST, FIPS PUB 113, "Computer Data Authentication," May 1985.
[MODES] Dworkin, M., "Recommendation for Block Cipher Modes of Operation: Methods and Techniques," NIST Special Publication 800-38A, December 2001.
[OCB] Rogaway, P., Bellare, M., Black, J. and T, Krovetz, "OCB: A block-Cipher Mod of Operation for Efficient Authenticated Encryption," 8th ACM Conference on Computer and Communications Security, pp 196-295, ACM Press, 2001.
[PROOF] Jonsson, J., "On the Security of CTR + CBC-MAC," SAC 2002 -- Ninth Annual Workshop on Selected Areas of Cryptography, Workshop Record version, 2002. Final version to appear in the LNCS Proceedings.
Russ Housley thanks the management at RSA Laboratories, especially Burt Kaliski, who supported the development of this cryptographic mode and this specification. The vast majority of this work was done while Russ was employed at RSA Laboratories.
Whiting, et al. Informational [Page 24]
RFC 3610 Counter with CBC-MAC (CCM) September 2003
Copyright (C) The Internet Society (2003). All Rights Reserved.
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assignees.
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by the Internet Society.