# MAC tag size in AES CCM, when using CTR + CBC-MAC (not CBC MAC only)

Assuming that AES CCM is used with respect of the NONCE unicity // the key life cycle, I wonder about the need of using the highest size for CBC-MAC authentication tag if CTR mode encrypts both payload AND authentication tag :

If no encryption is performed (e.g AES CBC MAC only), I understand the need of highest tag, i.e 128 bits , thus to prevent from brute force attack .

But : if the tag is ciphered using CTR mode as the payload is, I guess it guarantee that an adversary can not pickup any pair (Plain text / tag) and try to get another pair that matches ?

Any suggestions welcome, thanks !

2. Tag guessing, where you just try a random tag for a modified message succeeds with probability $2^{-t}$ if the tag is $t$ bits long.
The second works the same whether you use plain CBC-MAC (with prefix free messages) or in CCM where the authentication tag is encrypted. By using a tag smaller than 128 bits you increase the probability of the attacker creating a correct tag at random. Whether the tag is encrypted or not, the probability is always $2^{-t}$.
Where the encryption may matter is security after the birthday bound. CCM may offer authenticity even after you have used the key too many times to offer full privacy (i.e. close to $2^{64}$ blocks). Even there the tag length gives an upper bound for security, so that fact does not justify using a shorter tag.