CBC-MAC 8 octet ICV compatable with 16 octet block size? I'm trying to use DTLS in Preshared key mode for CoAP which necessitates using CipherSuite TLS_PSK_WITH_AES_128_CCM_8

I'm trying to start with the CBC-MAC but I'm not sure how to get an 8 octet ICV out of it?

Do I just truncate the output and only use the first 8 octets?

Do I use an 8 octet block size instead of the 16 imposed by the CBC function I'm using for hardware acceleration?

const unsigned char k[16] ="lbsHgUDHKgeinLfU";//key 128bits                


const unsigned char message[16] = "Hello world!  ";//multiple of 16 bytes as required
unsigned int mLen = sizeof(message);//16

unsigned char zeroInit[16]= {0};


//CBC-MAC with 8byte ICV
//uint8_t mac[8];//8 octet ICV (hopefully)
uint8_t mac[16];

esp_aes_crypt_cbc( &amp;c,ESP_AES_ENCRYPT,mLen,zeroInit, message, mac);


and the output I get is:
ad  ea  26  07  25  bb  43  8a  85  b5  ec  ca  6c  b6  b5  d3

The only difference I see with an array size of 8  is that I only see the first 8 bytes.
In general the authentication tag size is indeed generated by simply using the first (leftmost, in most byte array representation) bits. In general Tlen - the length of the tag - is supposed to be a multiple of eight, so a tag size of 64 bits results in the leftmost 8 bytes.

You cannot just change the block size of a block cipher. AES is only supporting a 128 bit / 16 byte block size (although Rijndael supports any block size between 128 and 256 bits inclusive using 32 bit increments). So changing the block size of a cipher is generally out of the question.



The usage of just the first/leftmost bytes out of the full MAC output is so widespread that an AEAD API interface that I wrote based the method signatures on the fact. Note that the output of a MAC is indistinguishable from random anyway, so in principle you can use any bits of the result; using the first/leftmost bytes is however the commonly agreed default.



If unsure: read the standard, NIST SP-800 38C:


  Set $T=\operatorname{MSB}_{Tlen}(Y_r)$


and


  $\operatorname{MSB}_s(X)$ : The bit string consisting of the $s$ left-most bits of the bit string $X$.