From 95059e4db270ea9d8a7e65e082f5b21f17ab5245 Mon Sep 17 00:00:00 2001 From: Munimen Security Date: Fri, 24 Jul 2026 11:15:55 +0100 Subject: [PATCH] Fix CMac init: size zero IV to cipher block size, not key length MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CMac.init sized the initial zero IV to `keyParams.key.length`. For AES-128 the key length (16) coincides with the AES block size (16), so it worked; but for AES-192/256 the IV became 24/32 bytes and CBCBlockCipher.init throws "Initialization vector must be the same length as block size", making CMAC with those key sizes unusable. Per NIST SP 800-38B the CMAC subkey derivation runs the block cipher over a zero block of the CIPHER BLOCK SIZE, independent of key length. Use `_cipher.blockSize`. This is fail-closed (it raised, never produced a weak MAC), but it blocks CMAC-AES-256 outright — e.g. reading ICAO 9303 eMRTDs that negotiate AES-256 PACE secure messaging. --- lib/macs/cmac.dart | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/macs/cmac.dart b/lib/macs/cmac.dart index c3170801..0ecbbbac 100644 --- a/lib/macs/cmac.dart +++ b/lib/macs/cmac.dart @@ -182,7 +182,7 @@ class CMac extends BaseMac { @override void init(covariant KeyParameter keyParams) { - final zeroIV = Uint8List(keyParams.key.length); + final zeroIV = Uint8List(_cipher.blockSize); _params = ParametersWithIV(keyParams, zeroIV); // Initialize before computing L, Lu, Lu2