Fix CMac init: size zero IV to cipher block size, not key length#263
Open
FerroLx wants to merge 1 commit into
Open
Fix CMac init: size zero IV to cipher block size, not key length#263FerroLx wants to merge 1 commit into
FerroLx wants to merge 1 commit into
Conversation
CMac.init sized the initial zero IV to `keyParams.key.length`. For AES-128 the key length (16) coincides with the AES block size (16), so it worked; but for AES-192/256 the IV became 24/32 bytes and CBCBlockCipher.init throws "Initialization vector must be the same length as block size", making CMAC with those key sizes unusable. Per NIST SP 800-38B the CMAC subkey derivation runs the block cipher over a zero block of the CIPHER BLOCK SIZE, independent of key length. Use `_cipher.blockSize`. This is fail-closed (it raised, never produced a weak MAC), but it blocks CMAC-AES-256 outright — e.g. reading ICAO 9303 eMRTDs that negotiate AES-256 PACE secure messaging.
FerroLx
force-pushed
the
fix/cmac-iv-block-size
branch
from
July 24, 2026 10:15
14cf7ae to
95059e4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
CMac.initsizes the initial zero IV tokeyParams.key.length:For AES-128 the key length (16) equals the AES block size (16), so it works. For
AES-192/256 the IV becomes 24/32 bytes and
CBCBlockCipher.initthrowsInitialization vector must be the same length as block size— CMAC with thosekey sizes is unusable.
Fix
Per NIST SP 800-38B, CMAC subkey derivation encrypts a zero block of the cipher
block size (independent of key length):
For AES-128 this is identical (16 == 16); for AES-192/256 it is correct instead of throwing.
Impact / how it was found
Surfaced reading an ICAO 9303 eMRTD (Portuguese Cartão de Cidadão) whose PACE secure
messaging negotiates AES-256: the PACE mutual-auth token and SM MAC use CMAC-AES-256
and crashed here. The bug is fail-closed (it raised, never produced a weak MAC), but it
blocks CMAC-AES-192/256 entirely. Verified end-to-end against a real card after this fix.