Why does TLS 1.3 support two CCM variants?

One of the important improvements introduced in TLS 1.3 is the pruning of the many previously available cipher suites to only five secure options (for symmetric ciphers), that are each supposed to have distinct advantages. For four of these, the advantages seem to be clear:

• TLS_AES_128_GCM_SHA256: faster on systems with hardware support for AES/GMCM.
• TLS_AES_256_GCM_SHA384: bigger numbers for regulatory (or marketing) reasons; resistant to Grover's algorithm.
• TLS_CHACHA20_POLY1305_SHA256: faster in software with no AES acceleration.
• TLS_AES_128_CCM_8_SHA256: useful for embedded devices that just want to reuse an AES circuit for both encryption and authentication; shorter tag.

However, I am still puzzled about the rationale behind the inclusion of TLS_AES_128_CCM_SHA256.

If I understand correctly, CCM with 64-bit authentication tags should be resistant against $$2^{64}$$ forgery attempts, which is also the maximal amount of messages TLS allows to be encrypted with the same key. So what is the added benefit of also supporting a version with 128-bit tags?

Of course I could be mistaken about CCM_8, and maybe it is not suitable for authenticating $$2^{64}$$ messages after all. But in that case, why doesn't RFC 8446 mention this in the "Limits on Key Usage" section? What am I missing here?

• Full CCM gives you a better probability of non-forgery even when the full $2^{64}$ messages are used. – SEJPM Nov 8 at 16:08
• Also, CCM is easier to implement than GCM and probably faster if only AES acceleration is available. Also it doesn't have the input size restrictions GCM has. – SEJPM Nov 8 at 16:17
• I think the answer lies simply in the fact that $2^{64}$ is not considered all that large when it comes to crypto. Generally you would try and achieve 128 bits of security, even though 64 bit security is rather a lot when it comes to MAC authentication. Not that I'm for inclusion of a lot of ciphersuites, SHA-384 might as well have been skipped in favor of SHA-512 and personally I would just have kept it to the 64 variant of the CCM authentication tag, as CCM is mainly useful for embedded devices. – Maarten Bodewes Nov 8 at 20:15