6 ms·
> 0¹²⁰10000111 for those of you(like me) wondering where this apparently spooky constant is coming from, it is a bitstring of the coefficients of the lexically
by d-z-m 2y ago
> 0¹²⁰10000111
for those of you(like me) wondering where this apparently spooky constant is coming from, it is a bitstring of the coefficients of the lexically first irreducible polynomial of degree b with the minimum possible number of non-zero terms, where b is the block size(in bits) of the underlying block cipher with which CMAC is instantiated. So, nothing up the sleeve here.
- Retr0id 2y agoMy natural follow-up question was "why can't you just have K1 = L?" Obviously it's inherited from CMAC, but why does CMAC do it? Investigating further, general-case CMAC involves generating a K1 and a K2, which afaict just need to be arbitrarily different from each other. So why not something even simpler, like "xor with 1"?
- deleted 2y ago[deleted]
- pbsd 2y agoThe multiplication in CMAC is there to distinguish between full and partial final input blocks. It can't be simply a xor with a constant because that would be easily cancelable in the input, and wouldn't satisfy the required xor-universal-like properties required by the security proof. The input here is highly restricted so there's no point to it.
- Dylan16807 2y agoMy reaction was "Huh? What multiplication?" The answer is that we're treating this as a Galois field/finite field of order 2^128 with the reducing polynomial (2^128 + 0b10000111). Under that framework, the left shift and possible XOR implement multiplication by 2. (An example of general multiplication here: https://en.wikipedia.org/wiki/Finite_field_arithmetic#Program_examples https://en.wikipedia.org/wiki/Finite_field_arithmetic#Progra...)
- Dylan16807 2y agoIt's an 8 bit constant padded to 128 bits, so while I appreciate the explanation it's not nearly enough entropy to spook me.