After xor: 7A F1 20 39 93 BF D1 06 1C 12 89 68 53 0F 24 FB [msg]
After AES: 51 77 41 69 C3 DE 6B 24 13 27 74 90 F5 FF C5 62
After xor: E6 EB 31 41 57 42 BB C8 13 27 74 90 F5 FF C5 62 [msg]
After AES: D4 CC 3B 82 DF 9F CC 56 7E E5 83 61 D7 8D FB 5E
CBC-MAC : D4 CC 3B 82 DF 9F CC 56
CTR Start: 01 00 33 56 8E F7 B2 63 3C 96 96 76 6C FA 00 01
CTR[0001]: DC EB F4 13 38 3C 66 A0 5A 72 55 EF 98 D7 FF AD
CTR[0002]: 2F 54 2C BA 15 D6 6C DF E1 EC 46 8F 0E 68 A1 24
CTR[MAC ]: 11 E2 D3 9F A2 E8 0C DC
Total packet length = 40. [Authenticated and Encrypted Output]
63 01 8F 76 DC 8A 1B CB 4C CB 1E 7C A9 81 BE FA
A0 72 6C 55 D3 78 06 12 98 C8 5C 92 81 4A BC 33
C5 2E E8 1D 7D 77 C0 8A
=============== Packet Vector #15 ==================
AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B
Nonce = 00 10 3F E4 13 36 71 3C 96 96 76 6C FA
Total packet length = 33. [Input with 8 cleartext header octets]
AA 6C FA 36 CA E8 6B 40 B9 16 E0 EA CC 1C 00 D7
DC EC 68 EC 0B 3B BB 1A 02 DE 8A 2D 1A A3 46 13
2E
CBC IV in: 59 00 10 3F E4 13 36 71 3C 96 96 76 6C FA 00 19
CBC IV out:B3 26 49 FF D5 9F 56 0F 02 2D 11 E2 62 C5 BE EA
After xor: B3 2E E3 93 2F A9 9C E7 69 6D 11 E2 62 C5 BE EA [hdr]
After AES: 82 50 9E E5 B2 FF DB CA 9B D0 2E 20 6B 3F B7 AD
After xor: 3B 46 7E 0F 7E E3 DB 1D 47 3C 46 CC 60 04 0C B7 [msg]
After AES: 80 46 0E 4C 08 3A D0 3F B9 A9 13 BE E4 DE 2F 66
After xor: 82 98 84 61 12 99 96 2C 97 A9 13 BE E4 DE 2F 66 [msg]
After AES: 47 29 CB 00 31 F1 81 C1 92 68 4B 89 A4 71 50 E7
CBC-MAC : 47 29 CB 00 31 F1 81 C1
CTR Start: 01 00 10 3F E4 13 36 71 3C 96 96 76 6C FA 00 01
CTR[0001]: 08 C4 DA C8 EC C1 C0 7B 4C E1 F2 4C 37 5A 47 EE
CTR[0002]: A7 87 2E 6C 6D C4 4E 84 26 02 50 4C 3F A5 73 C5
CTR[MAC ]: E0 5F B2 6E EA 83 B4 C7
Total packet length = 41. [Authenticated and Encrypted Output]
AA 6C FA 36 CA E8 6B 40 B1 D2 3A 22 20 DD C0 AC
90 0D 9A A0 3C 61 FC F4 A5 59 A4 41 77 67 08 97
08 A7 76 79 6E DB 72 35 06
=============== Packet Vector #16 ==================
AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B
Nonce = 00 76 4C 63 B8 05 8E 3C 96 96 76 6C FA
Total packet length = 31. [Input with 12 cleartext header octets]
D0 D0 73 5C 53 1E 1B EC F0 49 C2 44 12 DA AC 56
30 EF A5 39 6F 77 0C E1 A6 6B 21 F7 B2 10 1C
CBC IV in: 59 00 76 4C 63 B8 05 8E 3C 96 96 76 6C FA 00 13
CBC IV out:AB DC 4E C9 AA 72 33 97 DF 2D AD 76 33 DE 3B 0D
After xor: AB D0 9E 19 D9 2E 60 89 C4 C1 5D 3F F1 9A 3B 0D [hdr]
After AES: 62 86 F6 2F 23 42 63 B0 1C FD 8C 37 40 74 81 EB
After xor: 70 5C 5A 79 13 AD C6 89 73 8A 80 D6 E6 1F A0 1C [msg]
After AES: 88 95 84 18 CF 79 CA BE EB C0 0C C4 86 E6 01 F7
After xor: 3A 85 98 18 CF 79 CA BE EB C0 0C C4 86 E6 01 F7 [msg]
After AES: C1 85 92 D9 84 CD 67 80 63 D1 D9 6D C1 DF A1 11
CBC-MAC : C1 85 92 D9 84 CD 67 80
CTR Start: 01 00 76 4C 63 B8 05 8E 3C 96 96 76 6C FA 00 01
CTR[0001]: 06 08 FF 95 A6 94 D5 59 F4 0B B7 9D EF FA 41 DF
CTR[0002]: 80 55 3A 75 78 38 04 A9 64 8B 68 DD 7F DC DD 7A
CTR[MAC ]: 5B EA DB 4E DF 07 B9 2F
Total packet length = 39. [Authenticated and Encrypted Output]
D0 D0 73 5C 53 1E 1B EC F0 49 C2 44 14 D2 53 C3
96 7B 70 60 9B 7C BB 7C 49 91 60 28 32 45 26 9A
6F 49 97 5B CA DE AF
=============== Packet Vector #17 ==================
AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B
Nonce = 00 F8 B6 78 09 4E 3B 3C 96 96 76 6C FA
Total packet length = 32. [Input with 12 cleartext header octets]
77 B6 0F 01 1C 03 E1 52 58 99 BC AE E8 8B 6A 46
C7 8D 63 E5 2E B8 C5 46 EF B5 DE 6F 75 E9 CC 0D
CBC IV in: 59 00 F8 B6 78 09 4E 3B 3C 96 96 76 6C FA 00 14
CBC IV out:F4 68 FE 5D B1 53 0B 7A 5A A5 FB 27 40 CF 6E 33
After xor: F4 64 89 EB BE 52 17 79 BB F7 A3 BE FC 61 6E 33 [hdr]
After AES: 23 29 0E 0B 33 45 9A 83 32 2D E4 06 86 67 10 04
After xor: CB A2 64 4D F4 C8 F9 66 1C 95 21 40 69 D2 CE 6B [msg]
After AES: 8F BE D4 0F 8B 89 B7 B8 20 D5 5F E0 3C E2 43 11
After xor: FA 57 18 02 8B 89 B7 B8 20 D5 5F E0 3C E2 43 11 [msg]
After AES: 6A DB 15 B6 71 81 B2 E2 2B E3 4A F2 B2 83 E2 29
CBC-MAC : 6A DB 15 B6 71 81 B2 E2
CTR Start: 01 00 F8 B6 78 09 4E 3B 3C 96 96 76 6C FA 00 01
CTR[0001]: BD CE 95 5C CF D3 81 0A 91 EA 77 A6 A4 5B C0 4C
CTR[0002]: 43 2E F2 32 AE 36 D8 92 22 BF 63 37 E6 B2 6C E8
CTR[MAC ]: 1C F7 19 C1 35 7F CC DE
Total packet length = 40. [Authenticated and Encrypted Output]
77 B6 0F 01 1C 03 E1 52 58 99 BC AE 55 45 FF 1A
08 5E E2 EF BF 52 B2 E0 4B EE 1E 23 36 C7 3E 3F
76 2C 0C 77 44 FE 7E 3C
=============== Packet Vector #18 ==================
AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B
Nonce = 00 D5 60 91 2D 3F 70 3C 96 96 76 6C FA
Total packet length = 33. [Input with 12 cleartext header octets]
CD 90 44 D2 B7 1F DB 81 20 EA 60 C0 64 35 AC BA
FB 11 A8 2E 2F 07 1D 7C A4 A5 EB D9 3A 80 3B A8
7F
CBC IV in: 59 00 D5 60 91 2D 3F 70 3C 96 96 76 6C FA 00 15
CBC IV out:BA 37 74 54 D7 20 A4 59 25 97 F6 A3 D1 D6 BA 67
After xor: BA 3B B9 C4 93 F2 13 46 FE 16 D6 49 B1 16 BA 67 [hdr]
After AES: 81 6A 20 20 38 D0 A6 30 CB E0 B7 3C 39 BB CE 05
After xor: E5 5F 8C 9A C3 C1 0E 1E E4 E7 AA 40 9D 1E 25 DC [msg]
After AES: 6D 5C 15 FD 85 2D 5C 3C E3 03 3D 85 DA 57 BD AC
After xor: 57 DC 2E 55 FA 2D 5C 3C E3 03 3D 85 DA 57 BD AC [msg]
After AES: B0 4A 1C 23 BC 39 B6 51 76 FD 5B FF 9B C1 28 5E
CBC-MAC : B0 4A 1C 23 BC 39 B6 51
CTR Start: 01 00 D5 60 91 2D 3F 70 3C 96 96 76 6C FA 00 01
CTR[0001]: 64 A2 C5 56 50 CE E0 4C 7A 93 D8 EE F5 43 E8 8E
CTR[0002]: 18 E7 65 AC B7 B0 E9 AF 09 2B D0 20 6C A1 C8 3C
CTR[MAC ]: F7 43 82 79 5C 49 F3 00
Total packet length = 41. [Authenticated and Encrypted Output]
CD 90 44 D2 B7 1F DB 81 20 EA 60 C0 00 97 69 EC
AB DF 48 62 55 94 C5 92 51 E6 03 57 22 67 5E 04
C8 47 09 9E 5A E0 70 45 51
=============== Packet Vector #19 ==================
AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B
Nonce = 00 42 FF F8 F1 95 1C 3C 96 96 76 6C FA
Total packet length = 31. [Input with 8 cleartext header octets]
D8 5B C7 E6 9F 94 4F B8 8A 19 B9 50 BC F7 1A 01
8E 5E 67 01 C9 17 87 65 98 09 D6 7D BE DD 18
CBC IV in: 61 00 42 FF F8 F1 95 1C 3C 96 96 76 6C FA 00 17
CBC IV out:44 F7 CC 9C 2B DD 2F 45 F6 38 25 6B 73 6E 1D 7A
After xor: 44 FF 14 C7 EC 3B B0 D1 B9 80 25 6B 73 6E 1D 7A [hdr]
After AES: 57 C3 73 F8 00 AA 5F CC 7B CF 1D 1B DD BB 4C 52
After xor: DD DA CA A8 BC 5D 45 CD F5 91 7A 1A 14 AC CB 37 [msg]
After AES: 42 4E 93 72 72 C8 79 B6 11 C7 A5 9F 47 8D 9F D8
After xor: DA 47 45 0F CC 15 61 B6 11 C7 A5 9F 47 8D 9F D8 [msg]
After AES: 9A CB 03 F8 B9 DB C8 D2 D2 D7 A4 B4 95 25 08 67
CBC-MAC : 9A CB 03 F8 B9 DB C8 D2 D2 D7
CTR Start: 01 00 42 FF F8 F1 95 1C 3C 96 96 76 6C FA 00 01
CTR[0001]: 36 38 34 FA 28 83 3D B7 55 66 0D 98 65 0D 68 46
CTR[0002]: 35 E9 63 54 87 16 72 56 3F 0C 08 AF 78 44 31 A9
CTR[MAC ]: F9 B7 FA 46 7B 9B 40 45 14 6D
Total packet length = 41. [Authenticated and Encrypted Output]
D8 5B C7 E6 9F 94 4F B8 BC 21 8D AA 94 74 27 B6
DB 38 6A 99 AC 1A EF 23 AD E0 B5 29 39 CB 6A 63
7C F9 BE C2 40 88 97 C6 BA
=============== Packet Vector #20 ==================
AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B
Nonce = 00 92 0F 40 E5 6C DC 3C 96 96 76 6C FA
Total packet length = 32. [Input with 8 cleartext header octets]
74 A0 EB C9 06 9F 5B 37 17 61 43 3C 37 C5 A3 5F
C1 F3 9F 40 63 02 EB 90 7C 61 63 BE 38 C9 84 37
CBC IV in: 61 00 92 0F 40 E5 6C DC 3C 96 96 76 6C FA 00 18
CBC IV out:60 CB 21 CE 40 06 50 AE 2A D2 BE 52 9F 5F 0F C2
After xor: 60 C3 55 6E AB CF 56 31 71 E5 BE 52 9F 5F 0F C2 [hdr]
After AES: 03 20 64 14 35 32 5D 95 C8 A2 50 40 93 28 DA 9B
After xor: 14 41 27 28 02 F7 FE CA 09 51 CF 00 F0 2A 31 0B [msg]
After AES: B9 E8 87 95 ED F7 F0 08 15 15 F0 14 E2 FE 0E 48
After xor: C5 89 E4 2B D5 3E 74 3F 15 15 F0 14 E2 FE 0E 48 [msg]
After AES: 8F AD 0C 23 E9 63 7E 87 FA 21 45 51 1B 47 DE F1
CBC-MAC : 8F AD 0C 23 E9 63 7E 87 FA 21
CTR Start: 01 00 92 0F 40 E5 6C DC 3C 96 96 76 6C FA 00 01
CTR[0001]: 4F 71 A5 C1 12 42 E3 7D 29 F0 FE E4 1B E1 02 5F
CTR[0002]: 34 2B D3 F1 7C B7 7B C1 79 0B 05 05 61 59 27 2C
CTR[MAC ]: 7F 09 7B EF C6 AA C1 D3 73 65
Total packet length = 42. [Authenticated and Encrypted Output]
74 A0 EB C9 06 9F 5B 37 58 10 E6 FD 25 87 40 22
E8 03 61 A4 78 E3 E9 CF 48 4A B0 4F 44 7E FF F6
F0 A4 77 CC 2F C9 BF 54 89 44
=============== Packet Vector #21 ==================
AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B
Nonce = 00 27 CA 0C 71 20 BC 3C 96 96 76 6C FA
Total packet length = 33. [Input with 8 cleartext header octets]
44 A3 AA 3A AE 64 75 CA A4 34 A8 E5 85 00 C6 E4
15 30 53 88 62 D6 86 EA 9E 81 30 1B 5A E4 22 6B
FA
CBC IV in: 61 00 27 CA 0C 71 20 BC 3C 96 96 76 6C FA 00 19
CBC IV out:43 07 C0 73 A8 9E E1 D5 05 27 B2 9A 62 48 D6 D2
After xor: 43 0F 84 D0 02 A4 4F B1 70 ED B2 9A 62 48 D6 D2 [hdr]
After AES: B6 0B C6 F5 84 01 75 BC 01 27 70 F1 11 8D 75 10
After xor: 12 3F 6E 10 01 01 B3 58 14 17 23 79 73 5B F3 FA [msg]
After AES: 7D 5E 64 92 CE 2C B9 EA 7E 4C 4A 09 09 89 C8 FB
After xor: E3 DF 54 89 94 C8 9B 81 84 4C 4A 09 09 89 C8 FB [msg]
After AES: 68 5F 8D 79 D2 2B 9B 74 21 DF 4C 3E 87 BA 0A AF
CBC-MAC : 68 5F 8D 79 D2 2B 9B 74 21 DF
CTR Start: 01 00 27 CA 0C 71 20 BC 3C 96 96 76 6C FA 00 01
CTR[0001]: 56 8A 45 9E 40 09 48 67 EB 85 E0 9E 6A 2E 64 76
CTR[0002]: A6 00 AA 92 92 03 54 9A AE EF 2C CC 59 13 7A 57
CTR[MAC ]: 25 1E DC DD 3F 11 10 F3 98 11
Total packet length = 43. [Authenticated and Encrypted Output]
44 A3 AA 3A AE 64 75 CA F2 BE ED 7B C5 09 8E 83
FE B5 B3 16 08 F8 E2 9C 38 81 9A 89 C8 E7 76 F1
54 4D 41 51 A4 ED 3A 8B 87 B9 CE
=============== Packet Vector #22 ==================
AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B
Nonce = 00 5B 8C CB CD 9A F8 3C 96 96 76 6C FA
Total packet length = 31. [Input with 12 cleartext header octets]
EC 46 BB 63 B0 25 20 C3 3C 49 FD 70 B9 6B 49 E2
1D 62 17 41 63 28 75 DB 7F 6C 92 43 D2 D7 C2
CBC IV in: 61 00 5B 8C CB CD 9A F8 3C 96 96 76 6C FA 00 13
CBC IV out:91 14 AD 06 B6 CC 02 35 76 9A B6 14 C4 82 95 03
After xor: 91 18 41 40 0D AF B2 10 56 59 8A 5D 39 F2 95 03 [hdr]
After AES: 29 BD 7C 27 83 E3 E8 D3 C3 5C 01 F4 4C EC BB FA
After xor: 90 D6 35 C5 9E 81 FF 92 A0 74 74 2F 33 80 29 B9 [msg]
After AES: 4E DA F4 0D 21 0B D4 5F FE 97 90 B9 AA EC 34 4C
After xor: 9C 0D 36 0D 21 0B D4 5F FE 97 90 B9 AA EC 34 4C [msg]
After AES: 21 9E F8 90 EA 64 C2 11 A5 37 88 83 E1 BA 22 0D
CBC-MAC : 21 9E F8 90 EA 64 C2 11 A5 37
CTR Start: 01 00 5B 8C CB CD 9A F8 3C 96 96 76 6C FA 00 01
CTR[0001]: 88 BC 19 42 80 C1 FA 3E BE FC EF FB 4D C6 2D 54
CTR[0002]: 3E 59 7D A5 AE 21 CC A4 00 9E 4C 0C 91 F6 22 49
CTR[MAC ]: 5C BC 30 98 66 02 A9 F4 64 A0
Total packet length = 41. [Authenticated and Encrypted Output]
EC 46 BB 63 B0 25 20 C3 3C 49 FD 70 31 D7 50 A0
9D A3 ED 7F DD D4 9A 20 32 AA BF 17 EC 8E BF 7D
22 C8 08 8C 66 6B E5 C1 97
=============== Packet Vector #23 ==================
AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B
Nonce = 00 3E BE 94 04 4B 9A 3C 96 96 76 6C FA
Total packet length = 32. [Input with 12 cleartext header octets]
47 A6 5A C7 8B 3D 59 42 27 E8 5E 71 E2 FC FB B8
80 44 2C 73 1B F9 51 67 C8 FF D7 89 5E 33 70 76
CBC IV in: 61 00 3E BE 94 04 4B 9A 3C 96 96 76 6C FA 00 14
CBC IV out:0F 70 3F 5A 54 2C 44 6E 8B 74 A3 73 9B 48 B9 61
After xor: 0F 7C 78 FC 0E EB CF 53 D2 36 84 9B C5 39 B9 61 [hdr]
After AES: 40 5B ED 29 D0 98 AE 91 DB 68 78 F3 68 B8 73 85
After xor: A2 A7 16 91 50 DC 82 E2 C0 91 29 94 A0 47 A4 0C [msg]
After AES: 3D 03 29 3C FD 81 1B 37 01 51 FB C7 85 6B 7A 74
After xor: 63 30 59 4A FD 81 1B 37 01 51 FB C7 85 6B 7A 74 [msg]
After AES: 66 4F 27 16 3E 36 0F 72 62 0D 4E 67 7C E0 61 DE
CBC-MAC : 66 4F 27 16 3E 36 0F 72 62 0D
CTR Start: 01 00 3E BE 94 04 4B 9A 3C 96 96 76 6C FA 00 01
CTR[0001]: 0A 7E 0A 63 53 C8 CF 9E BC 3B 6E 63 15 9A D0 97
CTR[0002]: EA 20 32 DA 27 82 6E 13 9E 1E 72 5C 5B 0D 3E BF
CTR[MAC ]: B9 31 27 CA F0 F1 A1 20 FA 70
Total packet length = 42. [Authenticated and Encrypted Output]
47 A6 5A C7 8B 3D 59 42 27 E8 5E 71 E8 82 F1 DB
D3 8C E3 ED A7 C2 3F 04 DD 65 07 1E B4 13 42 AC
DF 7E 00 DC CE C7 AE 52 98 7D
=============== Packet Vector #24 ==================
AES Key = D7 82 8D 13 B2 B0 BD C3 25 A7 62 36 DF 93 CC 6B
Nonce = 00 8D 49 3B 30 AE 8B 3C 96 96 76 6C FA
Total packet length = 33. [Input with 12 cleartext header octets]
6E 37 A6 EF 54 6D 95 5D 34 AB 60 59 AB F2 1C 0B
02 FE B8 8F 85 6D F4 A3 73 81 BC E3 CC 12 85 17
D4
CBC IV in: 61 00 8D 49 3B 30 AE 8B 3C 96 96 76 6C FA 00 15
CBC IV out:67 AC E4 E8 06 77 7A D3 27 1D 0B 93 4C 67 98 15
After xor: 67 A0 8A DF A0 98 2E BE B2 40 3F 38 2C 3E 98 15 [hdr]
After AES: 35 58 F8 7E CA C2 B4 39 B6 7E 75 BB F1 5E 69 08
After xor: 9E AA E4 75 C8 3C 0C B6 33 13 81 18 82 DF D5 EB [msg]
After AES: 54 E4 7B 62 22 F0 BB 87 17 D0 71 6A EB AF 19 9E
After xor: 98 F6 FE 75 F6 F0 BB 87 17 D0 71 6A EB AF 19 9E [msg]
After AES: 23 E3 30 50 BC 57 DC 2C 3D 3E 7C 94 77 D1 49 71
CBC-MAC : 23 E3 30 50 BC 57 DC 2C 3D 3E
CTR Start: 01 00 8D 49 3B 30 AE 8B 3C 96 96 76 6C FA 00 01
CTR[0001]: 58 DB 19 B3 88 9A A3 8B 3C A4 0B 16 FF 42 2C 73
CTR[0002]: C3 2F 24 3D 65 DC 7E 9F 4B 02 16 AB 7F B9 6B 4D
CTR[MAC ]: 4E 2D AE D2 53 F6 B1 8A 1D 67
Total packet length = 43. [Authenticated and Encrypted Output]
6E 37 A6 EF 54 6D 95 5D 34 AB 60 59 F3 29 05 B8
8A 64 1B 04 B9 C9 FF B5 8C C3 90 90 0F 3D A1 2A
B1 6D CE 9E 82 EF A1 6D A6 20 59
9. Intellectual Property Statements
The authors hereby explicitly release any intellectual property
rights to CCM to the public domain. Further, the authors are not
aware of any patent or patent application anywhere in the world that
covers CCM mode. It is our belief that CCM is a simple combination
of well-established techniques, and we believe that CCM is obvious to
a person of ordinary skill in the arts.
10. Security Considerations
We claim that this block cipher mode is secure against attackers
limited to 2^128 steps of operation if the key K is 256 bits or
larger. There are fairly generic precomputation attacks against all
block cipher modes that allow a meet-in-the-middle attack on the key
K. If these attacks can be made, then the theoretical strength of
this, and any other, block cipher mode is limited to 2^(n/2) where n
is the number of bits in the key. The strength of the authentication
is of course limited by M.
Users of smaller key sizes (such as 128-bits) should take precautions
to make the precomputation attacks more difficult. Repeated use of
the same nonce value (with different keys of course) ought to be
avoided. One solution is to include a random value within the nonce.
Of course, a packet counter is also needed within the nonce. Since
the nonce is of limited size, a random value in the nonce provides a
limited amount of additional security.
11. References
This section provides normative and informative references.
11.1. Normative References
[STDWORDS] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
11.2. Informative References
[AES] NIST, FIPS PUB 197, "Advanced Encryption Standard (AES),"
November 2001.
[CCM] Whiting, D., Housley, R. and N. Ferguson, "AES Encryption
& Authentication Using CTR Mode & CBC-MAC," IEEE P802.11
doc 02/001r2, May 2002.
[ESP] Kent, S. and R. Atkinson, "IP Encapsulating Security
Payload (ESP)", RFC 2406, November 1998.
[MAC] NIST, FIPS PUB 113, "Computer Data Authentication," May
1985.
[MODES] Dworkin, M., "Recommendation for Block Cipher Modes of
Operation: Methods and Techniques," NIST Special
Publication 800-38A, December 2001.
[OCB] Rogaway, P., Bellare, M., Black, J. and T, Krovetz, "OCB:
A block-Cipher Mod of Operation for Efficient
Authenticated Encryption," 8th ACM Conference on Computer
and Communications Security, pp 196-295, ACM Press, 2001.
[PROOF] Jonsson, J., "On the Security of CTR + CBC-MAC," SAC 2002
-- Ninth Annual Workshop on Selected Areas of
Cryptography, Workshop Record version, 2002. Final
version to appear in the LNCS Proceedings.
12. Acknowledgement
Russ Housley thanks the management at RSA Laboratories, especially
Burt Kaliski, who supported the development of this cryptographic