MAC tag size in AES CCM, when using CTR + CBC-MAC (not CBC MAC only)

Question

Assuming that AES CCM is used with respect of the NONCE unicity // the key life cycle, I wonder about the need of using the highest size for CBC-MAC authentication tag if CTR mode encrypts both payload AND authentication tag :

If no encryption is performed (e.g AES CBC MAC only), I understand the need of highest tag, i.e 128 bits , thus to prevent from brute force attack .

But : if the tag is ciphered using CTR mode as the payload is, I guess it guarantee that an adversary can not pickup any pair (Plain text / tag) and try to get another pair that matches ?

Any suggestions welcome, thanks !

Answer 1

There are different "brute force" attacks related to CBC-MAC:

1. Key search, which depends on key size and not the length of the authentication tag.
2. Tag guessing, where you just try a random tag for a modified message succeeds with probability $2^{-t}$ if the tag is $t$ bits long.

The first is not related to the tag length at all and even if you use AES-128 you are secure from it. (As long as it's a random key, anyway: e.g. a password derived key could still be guessed with a non-brute force attack.)

The second works the same whether you use plain CBC-MAC (with prefix free messages) or in CCM where the authentication tag is encrypted. By using a tag smaller than 128 bits you increase the probability of the attacker creating a correct tag at random. Whether the tag is encrypted or not, the probability is always $2^{-t}$.

Where the encryption may matter is security after the birthday bound. CCM may offer authenticity even after you have used the key too many times to offer full privacy (i.e. close to $2^{64}$ blocks). Even there the tag length gives an upper bound for security, so that fact does not justify using a shorter tag.

None of that means you must use a 128-bit tag, of course. Forging a 64-bit tag, for example, would be very unlikely. It comes down to how sure you want to be about authenticity.