Aes Counter With Cbc-Mac (Ccm); Figure 96. Message Construction In Ccm Mode - ST STM32G0 1 Series Reference Manual

RM0444
20.4.12

AES counter with CBC-MAC (CCM)

Overview
The AES counter with cipher block chaining-message authentication code (CCM)
algorithm allows encryption and authentication of plaintext, generating the corresponding
ciphertext and tag (also known as message authentication code). To ensure confidentiality,
the CCM algorithm is based on AES in counter mode. It uses cipher block chaining
technique to generate the message authentication code. This is commonly called CBC-
MAC.
Note: NIST does not approve this CBC-MAC as an authentication mode outside the context of the
CCM specification.
CCM chaining is specified in NIST Special Publication 800-38C, Recommendation for Block
Cipher Modes of Operation - The CCM Mode for Authentication and Confidentiality. A typical
message construction for CCM is given in
16-byte
boundaries
[a]
B0
[a]
4-byte boundaries
flags Nonce (N)
Len(N)
Zero padding
The structure of the message is:
•
16-byte first authentication block (B0), composed of three distinct fields:
–
–
–
•
16-byte blocks (B) associated to the Associated Data (A).
This part of the message is only authenticated, not encrypted. This section has a
known length Len(A) that can be a non-multiple of 16 bytes (see

Figure 96. Message construction in CCM mode

Len(A)
32
Associated data (A) 0
16
Q
MAC (T)
Q: a bit string representation of the octet length of P (Len(P))
Nonce (N): a single-use value (that is, a new nonce must be assigned to each
new communication) of Len(N) size. The sum Len(N) + Len(P) must be equal to
15 bytes.
Flags: most significant octet containing four flags for control information, as
specified by the standard. It contains two 3-bit strings to encode the values t (MAC
length expressed in bytes) and Q (plaintext length such that Len(P) < 2
The counter blocks range associated to Q is equal to 2
value of Q is 8, the counter blocks used in cipher must be on 60 bits.
Figure 96.
Len(P)
Plaintext (P)
Authenticated & encrypted ciphertext (C)
Decrypt and compare
RM0444 Rev 5
AES hardware accelerator (AES)
Len(C)
0
8Q-4
, that is, if the maximum
Figure
Len(T)
Enc
(T)
MSv42159V2
8q
bytes).
96). The
499/1390
522