What is meant by a 'tag' with regards to transmitting a MAC?

Are there multiple meanings within cryptography?

Update - take this for example:

$Bob \to Alice \Rightarrow m\ ||\ h(m, ``secretTag")$


1 Answer 1


A tag or authentication tag is something that is attached to (tagged along with) a message. It provides integrity and authenticity to the message.

Tags are also calculated for authenticated ciphers (AEAD ciphers, such as GCM). They can in that case be calculated by an internal MAC algorithm, but this does not have to be the case.

The size of an authentication tag can usually be configured. The size must be predetermined before use however (or an attacker can simply try and crack a shorter authentication tag). Usually the size is between 64 and 128 bits (128 bits being the block size of e.g. AES), although hash based tags may be larger than that.

A tag is usually placed at the end of the ciphertext. It can however in principle be communicated or placed separate from the ciphertext.

I'm not aware of any other meaning of the word "tag" or "authentication tag" within cryptography.

  • $\begingroup$ Here though en.wikipedia.org/wiki/Authenticated_encryption An authentication tag is being suggest as part of the output of the encryption? Encryption Input: plaintext, key, and optionally a header in plaintext that will not be encrypted, but will be covered by authenticity protection. Output: ciphertext and authentication tag (Message Authentication Code). $\endgroup$ Commented Nov 16, 2016 at 12:40
  • $\begingroup$ Yes, that's correct. Authenticated ciphers output both a ciphertext and authentication tag. But it depends on the interpretation if the authentication tag is considered part of the ciphertext or not. For instance, the RFC specifying AEAD does handle the authentication tag that way, so does the Java API. But having looked at the implementation of such API I'd strongly advice against considering authentication tags as part of the ciphertext. It's much easier if you know exactly where the ciphertext ends and the authentication tag starts during decryption / verification. $\endgroup$
    – Maarten Bodewes
    Commented Nov 16, 2016 at 12:48
  • $\begingroup$ @NoDirection That of course depends on the viewpoint. For the sender it's output, for the receiver it is input ... That example is oversimplified. Obviously in real life situations you would want to have some kind of length indication of the message and authentication tag. Now if you know both the message size and the total size the tag size would be easy to compute. The problem is that if you receive that data through a stream (e.g. a socket), you would not know when the tag starts, so you don't know if the data is part of the message or the tag. So you need to rely on additional buffering. $\endgroup$
    – Maarten Bodewes
    Commented Nov 16, 2016 at 13:10
  • $\begingroup$ OK great, thanks for explaining! So a better way of computing that tag in the scenario would be to use some form of encryption? $\endgroup$ Commented Nov 16, 2016 at 13:19
  • $\begingroup$ No, the better way would be to use some kind of protocol that includes the sizes. I think that's just outside the scope of this example though. $\endgroup$
    – Maarten Bodewes
    Commented Nov 16, 2016 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.