I've seen NIST requirements about key length. What about the output lengths ?

Is 112 bits enough for the HMAC output length ? Can we truncate the tag to keep only 112 bits ?


Short answer, no.

The 112-bit value is actually the security parameter, and not necessarily the key length. For all NIST hash functions, the security provided is half the output bit of the hash function, therefore SHA-224 or better is required for 112-bit security. The security parameter we are considering is collision resistance.

However, there are other considerations for a MAC, such as how long the attacker will have to forge the code, which in some applications can be shorter than a second, and you can get away with a shorter code, such as 96-bits, which provides only 48-bits of security. A threat analysis of your application can determine if this is acceptable. 96 and 128-bit MACs are common lengths for short lived messages, with 128-bits becoming standard for new algorithms. How MAC failures are handled is also very important.

| improve this answer | |
  • $\begingroup$ so, for HMAC I can truncate to 96 bits and still have something "currently" secure ? $\endgroup$ – Dingo13 Nov 30 '14 at 13:23
  • $\begingroup$ as long as it is a short lived message, such as a network packet that will be verified less than a second after it is transmitted. for something stored on disk or in the cloud, you do not want truncation below your required security $\endgroup$ – Richie Frame Nov 30 '14 at 13:34
  • $\begingroup$ Thanks. "as long as it is a short lived message, such as a network packet that will be verified less than a second after it is transmitted". Where can we find this kind of requirements ? NIST ? $\endgroup$ – Dingo13 Dec 1 '14 at 7:27
  • $\begingroup$ RFC 2104 from 1997 recommended "not less than 80 bits", and 16 bits per decade is an appropriate increase. RFC 4635 from 2006 specifically calls for implementation of 96 bit truncation, and defines DNS query authentication $\endgroup$ – Richie Frame Dec 1 '14 at 10:16
  • 1
    $\begingroup$ Why do you consider collision resistance in the context of a MAC? I don't think this is relevant. AFAIK you get $n$ bits of security from a good $n$ bit MAC, and neither collisions nor multi-target attacks apply, assuming a sufficiently long key. $\endgroup$ – CodesInChaos Dec 1 '14 at 10:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.