Use of Same Key for CTR and CBC-MAC in CCM Mode of Operation? The NIST Specification Document for CCM Mode of operation 800-38C states on Page 13


  The same key, K, is used for both the CTR and CBC-MAC mechanisms
  within CCM.


is it secure to use same key? or one should prefer two distinct keys. One for CTR Mode and other for CBC-MAC?
Basically you should never reuse a key and neither should you use CBC-MAC. CCM is considered secure because the designer knew about the issues of reusing a key and CBC-MAC length extension issues. The scheme is designed to be secure regardless of these issues.

In a general sense you should always use two keys unless you can prove your scheme to be secure regardless of the fact that the key is reused. The same goes for CBC-MAC, CMAC or HMAC should be preferred instead - CBC-MAC is only secure if the size of the message is known in advance and CCM does take this into consideration.

Also note that if changes are made to your scheme, e.g. supplanting CTR by CBC by another designer/developer then reusing a key may cause your scheme to fail spectacularly. So if you do decide to go this route when creating a secure scheme / protocol then make sure you document it thoroughly.



CCM is a cipher with it's own packet format. This makes it suitable for low level packet encryption / decryption where speed is important. The choice of one key and CBC-MAC was likely inspired by this. For a more generic authenticated cipher mode I'd recommend EAX mode or GCM mode instead.