# Why does NaCl's crypto_auth have twice the security level of crypto_onetimeauth?

The crypto_auth function produces a 256-bit HMAC, with a 512-bit version also available. But the crypto_onetimeauth function (and the Box and SecretBox constructions that use it) only produces a 128-bit authenticator. Is there any particular reason NaCl doesn't include a 128-bit HMAC function?

• HMAC can be safely truncated if you want a short auth tag, but I'd avoid truncating Poly1305. – CodesInChaos Dec 30 '15 at 13:46

First is that the security models differ: crypto_onetimeauth only has to be secure for one message, while crypto_auth needs to be secure for any (practical) number of messages. The reason crypto_secretbox gets away with using the Poly1305 authenticator internally is that it generates message-specific authentication keys based on the nonce.
• Would you consider it kosher to truncate a crypto_auth MAC to 16 bytes? – Jack O'Connor Dec 30 '15 at 17:38