CCM mode

CCM mode (counter with cipher block chaining message authentication code; counter with CBC-MAC) is a mode of operation for cryptographic block ciphers. It is an authenticated encryption algorithm designed to provide both authentication and confidentiality. CCM mode is only defined for block ciphers with a block length of 128 bits.^[1]^[2]

The nonce of CCM must be carefully chosen to never be used more than once for a given key. This is because CCM is a derivation of counter (CTR) mode and the latter is effectively a stream cipher.^[3]

Encryption and authentication

As the name suggests, CCM mode combines counter (CTR) mode for confidentiality with cipher block chaining message authentication code (CBC-MAC) for authentication. These two primitives are applied in an "authenticate-then-encrypt" manner: CBC-MAC is first computed on the message to obtain a message authentication code (MAC), then the message and the MAC are encrypted using counter mode. The main insight is that the same encryption key can be used for both, provided that the counter values used in the encryption do not collide with the (pre-)initialization vector used in the authentication. A proof of security^[4] exists for this combination, based on the security of the underlying block cipher. The proof also applies to a generalization of CCM for any block size, and for any size of cryptographically strong pseudo-random function (since in both counter mode and CBC-MAC, the block cipher is only ever used in one direction).

CCM mode was designed by Russ Housley, Doug Whiting and Niels Ferguson. At the time CCM mode was developed, Russ Housley was employed by RSA Laboratories.

A minor variation of CCM, called CCM*, is used in the Zigbee standard. CCM* includes all of the features of CCM. It allows a choice of MAC lengths down to 0 (which disables authentication and becomes encryption-only).^[5]

Performance

CCM requires two block cipher encryption operations on each block of an encrypted-and-authenticated message, and one encryption on each block of associated authenticated data.

According to Crypto++ benchmarks, AES CCM requires 28.6 cycles per byte on an Intel Core 2 processor in 32-bit mode.^[6]

Notable inefficiencies:

CCM is not an "on-line" authenticated encryption with associated data (AEAD), in that the length of the message (and associated data) must be known in advance.
In the MAC construction, the length of the associated data has a variable-length encoding, which can be shorter than machine word size. This can cause pessimistic MAC performance if associated data is long (which is uncommon).
Associated data is processed after message data, so it is not possible to pre-calculate state for static associated data.

Patents

The catalyst for the development of CCM mode was the submission of offset codebook (OCB) mode for inclusion in the IEEE 802.11i standard. Opposition was voiced to the inclusion of OCB mode because of a pending patent application on the algorithm. Inclusion of a patented algorithm meant significant licensing complications for implementors of the standard.

While the inclusion of OCB mode was disputed based on these intellectual property issues, it was agreed that the simplification provided by an authenticated encryption system was desirable. Therefore, Housley, et al. developed CCM mode as a potential alternative that was not encumbered by patents.

Even though CCM mode is less efficient than OCB mode, a patent free solution was preferable to one complicated by patent licensing issues. Therefore, CCM mode went on to become a mandatory component of the IEEE 802.11i standard, and OCB mode was relegated to optional component status, before eventually being removed altogether.

Use

CCM mode is used in IEEE 802.11i (as CCMP, the CCM encryption protocol for WPA2), IPsec,^[7] and TLS 1.2,^[8] as well as Bluetooth Low Energy (as of Bluetooth 4.0).^[9] It is available for TLS 1.3, but not enabled by default in OpenSSL.^[10]

References

^ Dworkin, Morris (May 2004). Recommendation for Block Cipher Modes of Operation: The CCM Mode for Authentication and Confidentiality (PDF) (Technical report). NIST Special Publications. NIST. doi:10.6028/NIST.SP.800-38C. 800-38C.
^ Whiting, D.; Housley, R.; Ferguson, N. (September 2003). Counter with CBC-MAC (CCM). IETF. doi:10.17487/RFC3610. RFC 3610.
^ Housley, Russ (December 2005). "rfc4309". IETF: 3. AES CCM employs counter mode for encryption. As with any stream cipher, reuse of the same IV value with the same key is catastrophic.
^ Jonsson, Jakob (2003). "On the Security of CTR + CBC-MAC" (PDF). Selected Areas in Cryptography. Lecture Notes in Computer Science. Vol. 2595. pp. 76–93. doi:10.1007/3-540-36492-7_7. ISBN 978-3-540-00622-0.
^ "Annex B: CCM* mode of operation". IEEE Standard for Local and metropolitan area networks--Part 15.4: Low-Rate Wireless Personal Area Networks (LR-WPANs) (PDF). IEEE Standards. 2011-09-05. p. 229. Retrieved 2015-12-18.
^ "Crypto++ 5.6.0 Benchmarks". Crypto++. Retrieved 6 September 2015.
^ RFC 4309 Using Advanced Encryption Standard (AES) CCM Mode with IPsec Encapsulating Security Payload (ESP)
^ RFC 6655 AES-CCM Cipher Suites for Transport Layer Security (TLS)
^ "Bluetooth Low Energy Security". Archived from the original on 2016-04-02. Retrieved 2017-04-20.
^ Caswell, Matt (2017-05-04). "Using TLS1.3 With OpenSSL". OpenSSL blog. Retrieved 2024-10-11.

External links

RFC 3610: Counter with CBC-MAC (CCM)
RFC 4309: Using Advanced Encryption Standard (AES) CCM Mode with IPsec Encapsulating Security Payload (ESP)
RFC 6655: AES-CCM Cipher Suites for Transport Layer Security (TLS)
A Critique of CCM (by the designer of OCB)