# Does QUIC use a 96-bit MAC tag? If so, what are the implications?

Does QUIC use a 96-bit MAC tag? If so, what are the implications regarding forgery of messages?

One can argue about whether security for adversaries running in time $2^{96}$ is feasible or not, and the current standard is to require 128-bit security (or at least 112). However, an attack requiring sending in the range of $2^{90}$ messages to attempt to forge is way beyond feasible. The success probability of an attacker shouldn't exceed something reasonable, but what is reasonable is also subjective. NIST recommends that for block cipher modes of operation, the probability of a breach shouldn't exceed $2^{-32}$. For that reason, with a random IV, you can only use CTR or GCM to encrypt $2^{32}$ different messages (since the IV is of length 96 and you have a birthday problem). For MAC tags, taking 96 bits is more than enough...

• What about for Poly1305? – Demi Jun 8 '17 at 13:50

Just from the draft it seems that they only specify that AEAD is used but not which kind of tag specifically. However, the code for the go implementation does seem to use AES-GCM with 12 byte tags.

The implications are that finding a valid MAC by guessing randomly now only requires about $2^{95}$ guesses instead of $2^{127}$ when compared to a 16 byte tag. So it's obviously less secure but probably still perfectly fine in practice.

(Edit: As correctly pointed out by poncho the following paragraph does of course not apply to stream ciphers.) Especially, when considering that this will only allow you to mess with the associated data because there is probably some inherent formatting in the transmitted data. Therefore just messing with the encrypted payload will probably produce bogus plaintext which gives some extra security for that part.

• Actually, GCM with 96 bit tags and circa 1k ciphertexts allows a guess with probability $2^{-91}$, not $2^{-96}$. In addition, if the modified ciphertext validates, then flipping a bit in the ciphertext will flip the corresponding bit in the plaintext, hence the changes made to the plaintext are predictable (and hence I wouldn't count on any formatting check on the plaintext to save you) – poncho Jun 7 '17 at 22:58
• The question how much time you have to forge a valid MAC, you cannot hold back a packet indefinitely, so biggest danger would be packet injection, so the question is when the keys are rolled over. – eckes Jun 8 '17 at 0:54
• @poncho Where does this $2^{-91}$ probability come from? – Elias Jun 8 '17 at 6:15