From d011a614e70e86ece69e9281ebeeca627fa13880 Mon Sep 17 00:00:00 2001 From: Lealem Amedie Date: Mon, 20 Jul 2026 16:53:33 -0600 Subject: [PATCH] Increase WC_CMAC_TAG_MIN_SZ to SP800-38b recommendation --- wolfssl/wolfcrypt/cmac.h | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/wolfssl/wolfcrypt/cmac.h b/wolfssl/wolfcrypt/cmac.h index 39d7b6d624..0f71276290 100644 --- a/wolfssl/wolfcrypt/cmac.h +++ b/wolfssl/wolfcrypt/cmac.h @@ -99,14 +99,13 @@ struct Cmac { - -#ifndef NO_AES -#define WC_CMAC_TAG_MAX_SZ WC_AES_BLOCK_SIZE -#define WC_CMAC_TAG_MIN_SZ (WC_AES_BLOCK_SIZE/4) -#else /* Reasonable defaults */ -#define WC_CMAC_TAG_MAX_SZ 16 -#define WC_CMAC_TAG_MIN_SZ 4 +/* SP800-38b recommends a minimum tag length of 64-bits */ +#ifndef WC_CMAC_TAG_MAX_SZ + #define WC_CMAC_TAG_MAX_SZ 16 +#endif +#ifndef WC_CMAC_TAG_MIN_SZ + #define WC_CMAC_TAG_MIN_SZ 8 #endif #if FIPS_VERSION3_GE(6,0,0)