OMAC: One-Key CBC MAC — Addendum
Tetsu Iwata

Kaoru Kurosawa

Department of Computer and Information Sciences,
Ibaraki University
4–12–1 Nakanarusawa, Hitachi, Ibaraki 316-8511, Japan{iwata, kurosawa}@cis.ibaraki.ac.jp
March 10, 2003

1Introduction

In [2], we showed OMAC-family and suggested to use OMAC as a concrete choice of the parameters, where each member of OMAC-family is a provably secure CBC-type MAC scheme
for any message length which uses only one key.
In this note, we propose OMAC1, a new choice of the parameters of OMAC-family (see [4]for the details). Test vectors are also presented.
Accordingly, we rename the previous OMAC as OMAC2. (That is to say, test vectors for
OMAC2 were already shown in [3].) We use OMAC as a generic name for OMAC1 and OMAC2.

2Specification of OMAC1

Each member of OMAC-family is obtained by specifying• a block cipher E : {0, 1}k × {0, 1}n → {0, 1}n ,• an n-bit constant Cst,
• a universal hash function H : {0, 1}n ×X → {0, 1}n and two distinct constants Cst1 , Cst2 ∈X which satisfy some conditions,where k is a key length and n is a block length. It takes a block cipher key K ∈ {0, 1}k and amessage M ∈ {0, 1}∗ , and returns a tag T ∈ {0, 1}n .
Now OMAC1, a new choice of the parameters, is speciﬁed by
Cst = 0n , HL (x) = L · x, Cst1 = u, Cst2 = u2 ,where “·” denotes multiplication over GF(2n ). Equivalently,
L = EK (0n ), HL (Cst1 ) = L · u, HL (Cst2 ) = L · u2 .
OMAC1 is the same as OMAC2 (which is the previous OMAC) except for that Cst2 = u2
instead of Cst2 = u−1 . For comparison, OMAC2 was speciﬁed by
L = EK (0n ), HL (Cst1 ) = L · u, HL (Cst2 ) = L · u−1 .
Note that1

Algorithm OMAC1K (M )L ← EK (0n )Y [0] ← 0n
Partition M into M [1] · · · M [m]for i ← 1 to m − 1 do
X[i] ← M [i] ⊕ Y [i − 1]
Y [i] ← EK (X[i])X[m] ← padn (M [m]) ⊕ Y [m − 1]
if |M [m]| = nthen X[m] ← X[m] ⊕ L · uelse X[m] ← X[m] ⊕ L · u2
T ← EK (X[m])return T

Algorithm OMAC2K (M )L ← EK (0n )Y [0] ← 0n
Partition M into M [1] · · · M [m]for i ← 1 to m − 1 do
X[i] ← M [i] ⊕ Y [i − 1]
Y [i] ← EK (X[i])X[m] ← padn (M [m]) ⊕ Y [m − 1]
if |M [m]| = nthen X[m] ← X[m] ⊕ L · uelse X[m] ← X[m] ⊕ L · u−1
T ← EK (X[m])return T

Fig. 1. Description of OMAC1 and OMAC2.

M [1]

M [2]-?
f

M [3]-?
f

?
K- E?
K- E?
K- E?
TL·u

M [1]

M [2]-?
f?
K- E?
K- E

M [3] 10i  -?
fL · u2?
K- E?
TFig. 2. Illustration of OMAC1. Note that L = EK (0n ).
M [1]M [2]-?
f

M [3]
-?
f

?
K- E?
K- E?
K- E?
T

L·u

M [1]

M [2]
-?
f?
K- E?
K- E

M [3] 10i  -?
fL · u−1?
K- E?
TFig. 3. Illustration of OMAC2.

1. L · u and L · u2 = (L · u) · u can be computed eﬃciently from L and L · u only by one shift
and one conditional XOR, respectively.
2. In both OMAC1 and OMAC2, 1 = · · · = 6 = 2−n in where 1 , . . . , 6 are deﬁned in [2,Section 3]. This implies that there is no security diﬀerence between OMAC1 and OMAC2(see [4]).
OMAC1 and OMAC2 are described in Fig. 1 and illustrated in Fig. 2 and Fig. 3.

3Discussions• For OMAC1, we adopted u and u2 as Cst1 and Cst2 , since L · u and L · u2 = (L · u) ·u can be computed eﬃciently by one left shift and one conditional XOR from L andL · u, respectively. Note that this choice requires only a left shift. This would ease theimplementation of OMAC1, especially in hardware.

2• For OMAC2, we adopted u−1 instead of u2 as Cst2 . It requires one right shift to compute
L · u−1 instead of one left shift to compute (L · u) · u. This would allow to compute bothL · u and L · u−1 from L simultaneously if both left shift and right shift are available (forexample, the underlying block cipher uses both shifts).

4OMAC1 Test Vectors

In this section, we consider OMAC1 such that the AES [1] is used as the underlying blockcipher. Hence the tag length is n = 128 bits and the key consists of only the key of the AES.
For each of k = 128, 192, and 256 bits (the allowed key sizes of the AES), we present 4 test
vectors. Therefore 12 test vectors are given in total.
In what follows, the AES key is denoted by “K,” the message is denoted by “Msg,” andthe output of OMAC1 is denoted by “Tag.” All strings are expressed in hexadecimal notation.
(We use the same K and Msg as in [3].)4.1

AES-128

Test Vector for the Empty StringKMsg
Tag

2b7e151628aed2a6abf7158809cf4f3c
empty stringbb1d6929e95937287fa37d129b756746

Test Vector for 16-Byte Message
KMsg
Tag

2b7e151628aed2a6abf7158809cf4f3c
6bc1bee22e409f96e93d7e117393172a070a16b46b4d4144f79bdd9dd04a287c

Test Vector for 40-Byte Message
K
Msg

Tag

2b7e151628aed2a6abf7158809cf4f3c
6bc1bee22e409f96e93d7e117393172a
ae2d8a571e03ac9c9eb76fac45af8e51
30c81c46a35ce411
dfa66747de9ae63030ca32611497c827

Test Vector for 64-Byte Message
K
Msg

Tag

4.2

2b7e151628aed2a6abf7158809cf4f3c
6bc1bee22e409f96e93d7e117393172a
ae2d8a571e03ac9c9eb76fac45af8e51
30c81c46a35ce411e5fbc1191a0a52ef
f69f2445df4f9b17ad2b417be66c3710
51f0bebf7e3b9d92fc49741779363cfe

AES-192

Test Vector for the Empty String

3KMsgTag

8e73b0f7da0e6452c810f32b809079e5
62f8ead2522c6b7b
empty stringd17ddf46adaacde531cac483de7a9367

Test Vector for 16-Byte Message
KMsg
Tag

8e73b0f7da0e6452c810f32b809079e5
62f8ead2522c6b7b6bc1bee22e409f96e93d7e117393172a
9e99a7bf31e710900662f65e617c5184

Test Vector for 40-Byte Message
KMsg

Tag

8e73b0f7da0e6452c810f32b809079e5
62f8ead2522c6b7b6bc1bee22e409f96e93d7e117393172a
ae2d8a571e03ac9c9eb76fac45af8e51
30c81c46a35ce411
8a1de5be2eb31aad089a82e6ee908b0e

Test Vector for 64-Byte Message
KMsg

Tag

4.3

8e73b0f7da0e6452c810f32b809079e5
62f8ead2522c6b7b6bc1bee22e409f96e93d7e117393172a
ae2d8a571e03ac9c9eb76fac45af8e51
30c81c46a35ce411e5fbc1191a0a52ef
f69f2445df4f9b17ad2b417be66c3710
a1d5df0eed790f794d77589659f39a11

AES-256

Test Vector for the Empty String
KMsg
Tag

603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4
empty string
028962f61b7bf89efc6b551f4667d983

Test Vector for 16-Byte Message
KMsg
Tag

603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4
6bc1bee22e409f96e93d7e117393172a
28a7023f452e8f82bd4bf28d8c37c35c4

Test Vector for 40-Byte Message
KMsg

Tag

603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4
6bc1bee22e409f96e93d7e117393172a
ae2d8a571e03ac9c9eb76fac45af8e51
30c81c46a35ce411
aaf3d8f1de5640c232f5b169b9c911e6

Test Vector for 64-Byte Message
KMsg

Tag

603deb1015ca71be2b73aef0857d7781
1f352c073b6108d72d9810a30914dff4
6bc1bee22e409f96e93d7e117393172a
ae2d8a571e03ac9c9eb76fac45af8e51
30c81c46a35ce411e5fbc1191a0a52ef
f69f2445df4f9b17ad2b417be66c3710
e1992190549f6ed5696a2c056c315410

Acknowledgement
The authors would like to thank Phillip Rogaway of UC Davis, who suggested to use Cst2 = u2 .
We also thank Eisuke Kuroda and Yuki Ohira of Ibaraki University for implementing OMAC
and checking the test vectors.

References[1] FIPS Publication 197. Advanced Encryption Standard (AES).
Available at http://csrc.nist.gov/encryption/aes/.
[2] T. Iwata and K. Kurosawa. OMAC: One-Key CBC MAC. NIST submission, December
20, 2002, Available at http://csrc.nist.gov/CryptoToolkit/modes/proposedmodes/.
[3] T. Iwata and K. Kurosawa. OMAC Test Vectors. NIST submission, December 20, 2002,
Available at http://csrc.nist.gov/CryptoToolkit/modes/proposedmodes/.
[4] T. Iwata and K. Kurosawa. OMAC: One-Key CBC MAC. Proceedings version of [2].
Pre-proceedings of Fast Software Encryption, FSE 2003, pp. 137–161, February 2003. See
Cryptology ePrint Archive, Report 2002/180 at http://eprint.iacr.org/2002/180/.

5