CMAC for messages shorter than 128bit RFC4493 describes the generation of AES-CMAC and padding for messages with length > sizeof(aes128_key). However I need to generate the CMAC for a series of messages shorter than 16 byte.

So I'd like to ask if it is viable to:


Pad M0 with 0 up to 16 bytes
Pad M_last with the proposed padding (first bit 1, others 0)


As the message always will be M0 || M1 with a fixed size, is the subkey generation still required? Or can it be replaced by a fixed value?

Kind regards
AES-CMAC is defined for messages of any length.

The algorithm can be reduced to the following, if you have non-empty messages smaller than the block size:

(K1,K2) := Generate_Subkey(K);
n := ceil(len/const_Bsize);
M_last := padding(M_n) XOR K2; 
X := const_Zero;
Y := M_last XOR X;
T := AES-128(K,Y);
return T;


You don't need to derive some non-standard way of padding your messages.



You should note that len/const_Bsize in the RFC is floating point division. The C implementation does this little trick to not use floating point division: n = (length+15) / 16;.

Shameless plug: I have a JavaScript implementation of AES-CMAC that you can play around in: Online AES-CMAC calculator