Counter With Cipher Block Chaining Message Authentication Code (ccm)

CCM is an authenticated-encryption mode that combines Counter mode for encryption with Cipher Block Chaining Message Authentication Code, or CBC-MAC, for authentication. It is designed to protect both confidentiality and integrity. The mode is standardized for use with an approved block cipher and requires correct nonce, key, and parameter management.

CCM first uses CBC-MAC to compute an authentication value over the message and associated data, then uses Counter mode to encrypt the message and protect the authentication tag. The two components use the same underlying block cipher but perform different jobs: Counter mode provides confidentiality, while CBC-MAC contributes integrity and authenticity.

CCM provides authenticated encryption: confidentiality for the protected plaintext plus integrity and authenticity checks that help detect unauthorized modification. Security depends on following the standardized construction, especially using unique nonces as required and protecting cryptographic keys. Reusing parameters incorrectly can undermine security even when the underlying block cipher is strong.