RFC 2104 says:
Applications of HMAC can choose to truncate the output of HMAC by outputting the
t
leftmost bits of the HMAC computation for some parametert
[...]. We recommend that the output lengtht
be not less than half the length of the hash output (to match the birthday attack bound) and not less than 80 bits (a suitable lower bound on the number of bits that need to be predicted by an attacker).
Obviously, different lengths of HMAC outputs provide different levels of security. What's not obvious to me, is: If one needs the security provided by a 128-bit MAC, why is HMAC-SHA-256 suitable to generate such (half the length of the hash = 128 bits) but HMAC-SHA-512 is not (half the length of the hash = 256 bits)?