I've seen NIST requirements about key length. What about the output lengths ?
Is 112 bits enough for the HMAC output length ? Can we truncate the tag to keep only 112 bits ?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
Short answer, no.
The 112-bit value is actually the security parameter, and not necessarily the key length. For all NIST hash functions, the security provided is half the output bit of the hash function, therefore SHA-224 or better is required for 112-bit security. The security parameter we are considering is collision resistance.
However, there are other considerations for a MAC, such as how long the attacker will have to forge the code, which in some applications can be shorter than a second, and you can get away with a shorter code, such as 96-bits, which provides only 48-bits of security. A threat analysis of your application can determine if this is acceptable. 96 and 128-bit MACs are common lengths for short lived messages, with 128-bits becoming standard for new algorithms. How MAC failures are handled is also very important.