Given $plaintext$ and its respective authentication $tag$ which is generated from HMAC-MD5 so that $|tag| = 128$ bits.

If the application is constrained and can send only $64$ bits. Is it ok, if we xor the first $8$ bytes and second $8$ bytes of the $tag$ in order to generate a total $64$ bit $tag$?

I believe the strengthen is really in the key size not really the output size for somebody to do a brute force. What worse can happen is two different inputs could have same signature if we are doing the above ?

Or does this weaken the strengthen in any way?

  • 5
    $\begingroup$ I'd simply truncate instead of xoring the halves. $\endgroup$ Commented Aug 11, 2016 at 8:30

1 Answer 1


Key and tag lengths matter independently. A short tag allows a random guess to be valid more often, but does not help an attacker in finding the key. Rather than XOR, NIST recommends truncation if you need a shorter MAC tag. SP 800-107 (pdf) says to use at least 32 bits:

When an application truncates the HMAC output to generate a MacTag to a desired length, λ, the λ left-most bits of the HMAC output shall be used as the MacTag. However, the output length, λ, shall be no less than 32 bits.

However, using at least 64 bits is recommended:

A commonly acceptable length for the MacTag is 64 bits; MacTags with lengths shorter than 64 bits are discouraged.

Other than that, I would not use HMAC-MD5, although it has not been broken. HMAC-SHA256 (or HMAC-SHA512 if that is faster) can be truncated to the same size.

  • $\begingroup$ with MD5, and the fact that the target MAC size is half the hash size, I would probably XOR the 2 halves rather than truncate $\endgroup$ Commented Aug 11, 2016 at 8:20
  • $\begingroup$ @otus , a follow up related question , can that 64 bit tag be used as a random number ? $\endgroup$
    – sashank
    Commented Aug 11, 2016 at 8:25
  • $\begingroup$ @sashank Depends on the protocol. You'd normally assume that the tag is known, so that has to be taken into account. 64 bit numbers are also tricky wrt the birthday problem (in other words, your chances of hitting a dupe are getting serious after ~ 2^32 random numbers). Related topic: KBKDF's such as HKDF (which uses HMAC underneath). $\endgroup$
    – Maarten Bodewes
    Commented Aug 11, 2016 at 8:35
  • 1
    $\begingroup$ @sashank, so you use it as a PRF? Yes, that is fine as well. $\endgroup$
    – otus
    Commented Aug 11, 2016 at 12:18
  • 1
    $\begingroup$ If you only need a 64-bit tag and your input messages are short you could also consider SipHash. $\endgroup$ Commented Aug 11, 2016 at 20:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.