DataTerminology.comNEW
Also known as: Counter Mode with CBC-MAC Protocol
An AES-based encryption and authentication protocol for WPA2 that provides confidentiality, integrity, and replay protection.
DESCRIPTION
AES-CCMP is the cryptographic protocol underpinning WPA2 Wi‑Fi security, using CCM mode with AES for combined encryption and message authentication. It replaces older TKIP, offering stronger protection against tampering and replay attacks. CCMP leverages counter mode for confidentiality and CBC-MAC for integrity, producing an authentication tag per packet. It is defined by IEEE 802.11i and widely implemented in enterprise and consumer wireless networks. While robust, newer deployments increasingly favor AES-GCM and WPA3 for performance and security.
ALTERNATIVE DEFINITIONS
IETF
This memo describes the Counter with CBC-MAC (CCM) mode of operation, which provides both authentication and confidentiality.
Defines CCM, the underlying mode for CCMP that combines encryption and authentication.
NIST
This Recommendation specifies the CCM mode of operation for a block cipher: a single mode that provides both authenticated encryption and message authentication.
Authoritative specification of CCM as an AEAD mode used in CCMP.
Wikipedia
CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) is an encryption protocol for wireless networks based on the Advanced Encryption Standard (AES) block cipher.
Highlights CCMP’s role in wireless networks and AES basis.
RELATED TERMS
WPA2 Rijndael Counter Mode with CBC-MAC IEEE 802.11i Galois-Counter Mode Counter Authentication Tag Replay Protection Key Management Temporal Key Integrity Protocol
COMPETING TERMS
RELATIONS
- Broader: Counter Mode with CBC-MAC
- Conforms to: IEEE 802.11i
KNOWLEDGE AREAS
Data Security Data Privacy & Compliance Infrastructure Software Engineering
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Chief Information Security Officer Software Developer Cloud Architect
EXTERNAL SOURCES
- Wikipedia - CCMP
- NIST - CCM specification used by CCMP
- IETF - CCM mode overview and details
- Wi‑Fi Alliance - Wi‑Fi security specifications
TOP QUESTIONS
What problem does AES-CCMP solve in WPA2 networks?
AES-CCMP provides strong encryption and integrity to protect Wi‑Fi traffic from eavesdropping, tampering, and replay attacks, replacing weaker TKIP.
Category: Problem
How does AES-CCMP combine confidentiality and integrity?
It uses counter mode for encryption and CBC-MAC for authentication, producing an integrity tag per packet.
Category: Concept
Why do some deployments move from AES-CCMP to AES-GCM?
AES-GCM offers faster performance with parallelizable authentication and is favored in modern protocols like TLS and WPA3.
Category: Trend
What are common misconfigurations with AES-CCMP?
Weak passphrases, obsolete cipher fallback, and disabled management frame protection can undermine CCMP’s security.
Category: Mistakes
Is AES-CCMP compliant with modern security standards?
Yes, it is standardized and widely accepted; however, WPA3 and GCM-based modes may be recommended for future-proofing.
Category: Compliance
Does AES-CCMP protect against replay attacks?
Yes, CCMP uses per-packet nonces and sequence numbers to provide replay protection.
Category: Capability
How should enterprises manage keys with AES-CCMP?
Use strong passphrases or 802.1X with enterprise authentication, rotate keys, and enforce policy for secure onboarding.
Category: Management
What is the biggest misunderstanding about AES-CCMP?
Some assume CCMP alone solves all Wi‑Fi risks; in reality, secure authentication, proper configuration, and patching are also critical.
Category: Misunderstanding
Where can engineers learn standards behind AES-CCMP?
Study NIST SP 800-38C and RFC 3610 for CCM, and IEEE 802.11i for the Wi‑Fi protocol context.
Category: Learning