CMAC computation using white-box implementations with external encodings

A method for mapping an input message to a message authentication code (MAC) by a white-box implementation of a keyed cryptographic operation in a cryptographic system implemented in a microprocessor and a memory coupled to the microprocessor, the method comprising:

• calculating k0=H(Ek(0)), where H is a first encoding function, Ek is a white-box implementation of a block cipher using a key k;
• calculating k1=k0«1 when msb(k0)=0 or k1=ENC1(k0«1) when msb(k0)=1 where ENC1 is a second encoding function;
• calculating k2=k1«1 when msb(k1)=0 or k2=ENC2 (k1«1) when msb(k1)=1 w here ENC2 is a third encoding function;
• dividing the input message into h-bit blocks m=m1∥ . . . ∥mn−1∥mn, where m1, . . . , mn−1 are complete blocks where b is an integer;
• calculating mn′=ENC3(k1⊕mn) when mn is a complete block and mn′=ENC3(k2 ⊕(mn∥ 10 . . . 02)) when mn is an incomplete block where ENC3 is a fourth encoding function;
• calculating ci=Encrypti(ci−1⊕mi) for i=1, . . . , n−1, where c0=00 . . . 02, Encrypti(x)=Fi/2+1(Ek(x)) when i is odd or Encrypti(x)=(Ek(Fi/2+1−1(x)) when i is even, and Fi is a fifth encoding function;
• calculating cn=Ek(G−1(cn−1⊕mn′));
• and
• outputting the MAC as a portion of cn, wherein the MAC is bound to the white-box implementation of a data processing system.