CMAC.

Good morning,

Pardon me if I've sent this through before.

Is there any reason CMAC isn't defined in the specifications? CMAC will
allow you to recycle the block cipher you're already using (AES), which
reduces the number of primitives necessary to encrypt and authenticate; in
turn, this adds a bit of cleanliness to the code, which should be a primary
focus of any attempt at real-world cryptographic design. Security-wise,
HMAC and CMAC are both SUF-CMA, so I'm not concerned about that; it just
seems logical to give your block cipher the opportunity to authenticate too.

Cheers,

Justin