0
$\begingroup$

Just a quick question: I've seen implemented BouncyCastle's class AeadParameters with MAC length of 128 bits, which was allegedly recommended. Though when I looked up HMac to implement my own MAC in CBCBlockCipher, I found people using HMac with only SHA256, which results in MAC's length of only 32 bytes.

So what route should I take? Should I implement something like SHA512 to gain some MAC length?

$\endgroup$
4
  • 1
    $\begingroup$ bytes vs bits, also SHA256 is 32 bytes $\endgroup$ Commented Mar 21, 2018 at 17:05
  • $\begingroup$ @RichieFrame Ah, I forgot that AeadParameters takes MAC length in bits. Sorry about that. Thanks! $\endgroup$
    – daralim
    Commented Mar 21, 2018 at 17:10
  • 2
    $\begingroup$ IMO there is little reason to use a MAC longer than 128 bits (16 bytes), even when using 256-bit keys. $\endgroup$ Commented Mar 21, 2018 at 17:12
  • $\begingroup$ The title of this question might as well change to "MAC size 512 bits vs 1024 bits". $\endgroup$
    – DannyNiu
    Commented Mar 22, 2018 at 1:37

1 Answer 1

1
$\begingroup$

It seems that this is just a misunderstanding between bits and bytes. 32 bytes is 256 bits, so 32 bytes is more than enough.

The security of HMAC is very strong; the security is directly related to the minimum of the key size and HMAC output size. So using 32 bytes / 256 bits as output size is fine. You could use fewer bytes for the authentication tag (using the leftmost bytes is the default), but it is recommended to keep to the default. Using SHA-512/256 might be a good idea for larger messages on 64 bit machines. SHA-224 could also be an option if you require a smaller authentication tag. For a newer protocol you could go with KMAC / SHA-3.

AEAD ciphers almost exclusively use the block cipher for the final calculation to produce the authentication tag. If AES or an AES finalist is used then the block size will be 128 bits - which means that 128 bit is the maximum authentication tag supported. You could go for a smaller authentication tag than 128 for real time protocols or protocols for embedded devices. In that case GCM is not recommended as there are security concerns if smaller tag sizes are used for that mode. CCM or EAX mode would make more sense for smaller authentication tags. These modes use CBC-MAC and CMAC respectively.

Note that the verification of an authentication tag should be performed using a constant time compare.

$\endgroup$
3
  • $\begingroup$ Ok, so I can use AEAD cipher, GCM mode with MAC 128 bit length even for longer messages. Though when I create MAC with e.g. HMAC, I should use SHA256 or even SHA512 for longer messages? $\endgroup$
    – daralim
    Commented Mar 22, 2018 at 10:11
  • 1
    $\begingroup$ Yes, just use GCM but do check the limitations for very large messages regardless of the MAC size. GCM has some drawbacks in that regard. If you use SHA-256 or SHA-512 is up to you. Both are secure enough. SHA-256 has a smaller tag size and using SHA-512 for smaller sizes may not be feasible (without custom changes) for all runtimes. SHA-512 is however faster on 64 bit machines. Sorry, your choice. $\endgroup$
    – Maarten Bodewes
    Commented Mar 22, 2018 at 11:38
  • 2
    $\begingroup$ Oh, and for HMAC over ciphertext: don't forget to include the IV, otherwise the decrypted plaintext may still be altered by changing the IV. $\endgroup$
    – Maarten Bodewes
    Commented Mar 22, 2018 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.