CCM mode (counter with cipher block chaining message authentication code;counter withCBC-MAC) is amode of operation for cryptographicblock ciphers. It is anauthenticated encryption algorithm designed to provide bothauthentication andconfidentiality. CCM mode is only defined for block ciphers with a block length of 128 bits.[1][2]
Thenonce of CCM must be carefully chosen to never be used more than once for a givenkey.This is because CCM is a derivation ofcounter (CTR) mode and the latter is effectively astream cipher.[3]
As the name suggests, CCM mode combinescounter (CTR) mode for confidentiality withcipher block chaining message authentication code (CBC-MAC) for authentication. These two primitives are applied in an "authenticate-then-encrypt" manner: CBC-MAC is first computed on the message to obtain amessage authentication code (MAC), then the message and the MAC are encrypted using counter mode. The main insight is that the same encryption key can be used for both, provided that the counter values used in the encryption do not collide with the (pre-)initialization vector used in the authentication. Aproof of security[4] exists for this combination, based on the security of the underlying block cipher. The proof also applies to a generalization of CCM for anyblock size, and for any size ofcryptographically strongpseudo-random function (since in both counter mode and CBC-MAC, the block cipher is only ever used in one direction).
CCM mode was designed byRuss Housley, Doug Whiting andNiels Ferguson. At the time CCM mode was developed, Russ Housley was employed byRSA Laboratories.
A minor variation of CCM, called CCM*, is used in theIEEE 802.15.4 standard, used as theMAC layer inZigbee . CCM* includes all of the features of CCM. It allows a choice of MAC lengths down to 0 (which disables authentication and becomes encryption-only).[5]
CCM requires two block cipher encryption operations on each block of an encrypted-and-authenticated message, and one encryption on each block of associated authenticated data.
According toCrypto++ benchmarks, AES CCM requires 28.6cycles per byte on anIntel Core 2 processor in 32-bit mode.[6]
Notable inefficiencies:
The catalyst for the development of CCM mode was the submission ofoffset codebook (OCB) mode for inclusion in theIEEE 802.11i standard. Opposition was voiced to the inclusion of OCB mode because of a pendingpatent application on thealgorithm. Inclusion of a patented algorithm meant significant licensing complications for implementors of the standard.
While the inclusion of OCB mode was disputed based on theseintellectual property issues, it was agreed that the simplification provided by an authenticated encryption system was desirable. Therefore, Housley, et al. developed CCM mode as a potential alternative that was not encumbered by patents.
Even though CCM mode is less efficient than OCB mode, a patent free solution was preferable to one complicated by patent licensing issues. Therefore, CCM mode went on to become a mandatory component of the IEEE 802.11i standard, and OCB mode was relegated to optional component status, before eventually being removed altogether.
CCM mode is used inIEEE 802.11i (asCCMP, the CCM encryption protocol forWPA2),IPsec,[7] andTLS 1.2,[8] as well asBluetooth Low Energy (as ofBluetooth 4.0).[9] It is available for TLS 1.3, but not enabled by default inOpenSSL.[10]
AES CCM employs counter mode for encryption. As with any stream cipher, reuse of the same IV value with the same key is catastrophic.
