Table of Contents

Class AesCmac

Namespace
CryptoHives.Foundation.Security.Cryptography.Mac
Assembly
CryptoHives.Foundation.Security.Cryptography.dll

Computes AES-CMAC (Cipher-based Message Authentication Code) as defined in NIST SP 800-38B and RFC 4493.

public sealed class AesCmac : IMac, IDisposable
Inheritance
AesCmac
Implements
Inherited Members

Examples

byte[] key = new byte[16]; // AES-128 key
byte[] data = Encoding.UTF8.GetBytes("Hello, World!");

using var cmac = AesCmac.Create(key);
byte[] tag = cmac.ComputeHash(data);

Remarks

This is a fully managed implementation of AES-CMAC that uses the CryptoHives AES cipher. It does not rely on OS or hardware cryptographic APIs, ensuring deterministic behavior across all platforms.

AES-CMAC produces a 128-bit (16-byte) authentication tag and supports AES-128, AES-192, and AES-256 key sizes.

Unlike HMAC which requires two passes, CMAC computes the tag in a single pass using the underlying block cipher in CBC mode with derived subkeys.

Constructors

AesCmac(byte[])

Initializes a new instance of the AesCmac class.

public AesCmac(byte[] key)

Parameters

key byte[]

The secret key. Must be 16, 24, or 32 bytes.

Exceptions

ArgumentException

The key length is invalid.

AesCmac(ReadOnlySpan<byte>)

Initializes a new instance of the AesCmac class.

public AesCmac(ReadOnlySpan<byte> key)

Parameters

key ReadOnlySpan<byte>

The secret key. Must be 16, 24, or 32 bytes.

Exceptions

ArgumentException

The key length is invalid.

Properties

AlgorithmName

Gets the name of the MAC algorithm.

public string AlgorithmName { get; }

Property Value

string

MacSize

Gets the MAC output size in bytes.

public int MacSize { get; }

Property Value

int

Methods

ComputeHash(byte[])

Computes the AES-CMAC tag for the given data in a single operation.

public byte[] ComputeHash(byte[] data)

Parameters

data byte[]

The data to authenticate.

Returns

byte[]

The 16-byte MAC tag.

ComputeHash(ReadOnlySpan<byte>)

Computes the AES-CMAC tag for the given data in a single operation.

public byte[] ComputeHash(ReadOnlySpan<byte> data)

Parameters

data ReadOnlySpan<byte>

The data to authenticate.

Returns

byte[]

The 16-byte MAC tag.

Create(byte[])

Creates a new instance of the AesCmac class.

public static AesCmac Create(byte[] key)

Parameters

key byte[]

The secret key.

Returns

AesCmac

A new AES-CMAC instance.

Create(ReadOnlySpan<byte>)

Creates a new instance of the AesCmac class.

public static AesCmac Create(ReadOnlySpan<byte> key)

Parameters

key ReadOnlySpan<byte>

The secret key.

Returns

AesCmac

A new AES-CMAC instance.

Dispose()

Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources.

public void Dispose()

Finalize(Span<byte>)

Computes the final MAC tag and writes it to destination.

public void Finalize(Span<byte> destination)

Parameters

destination Span<byte>

The buffer to receive the MAC tag. Must be at least MacSize bytes.

Exceptions

ArgumentException

destination is too small.

ObjectDisposedException

Thrown when the instance has been disposed.

Hash(byte[], byte[])

Computes the AES-CMAC tag for the specified key and data in a single operation.

public static byte[] Hash(byte[] key, byte[] data)

Parameters

key byte[]

The secret key.

data byte[]

The data to authenticate.

Returns

byte[]

The 16-byte MAC tag.

Reset()

Resets the MAC to its initial state so it can be reused with the same key.

public void Reset()

Update(ReadOnlySpan<byte>)

Feeds input data into the MAC computation.

public void Update(ReadOnlySpan<byte> input)

Parameters

input ReadOnlySpan<byte>

The data to process.

Exceptions

ObjectDisposedException

Thrown when the instance has been disposed.

Edit this page