0
$\begingroup$

I want to use AES-GCM to encrypt 7 Byte data chunks.

A 16 Byte MAC seems like overkill to me and the library I'm using gives me the option to make the MAC smaller.

Are there any criteria for choosing the length of the MAC or are fewer bytes always less security?

| improve this question | |
$\endgroup$
  • 1
    $\begingroup$ please check this answer Ciphertext and tag size and IV transmission with AES in GCM mode The answer might give the answer to your question $\endgroup$ – kelalaka Jan 12 '19 at 21:19
  • $\begingroup$ @kelalaka I seriously cannot access the Nist GCM specification, because of the government shutdown. Geez. Still looks promising, though. Will search for a mirror. $\endgroup$ – Minix Jan 12 '19 at 21:29
  • $\begingroup$ Well ACM have it :) $\endgroup$ – kelalaka Jan 12 '19 at 21:32
  • 1
    $\begingroup$ @kelalaka Exactly where I ended up :) Appendix C, Table 1 seems to answer my question. Do you want to write it up as an answer? $\endgroup$ – Minix Jan 12 '19 at 21:53
2
$\begingroup$

In Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC Appendix C, Table 1 & 2 NIST gives the recommended maximum number of invocations of the decrypt function of GCM for different message lengths using a MAC of 4 and 8 Byte.

My message length of 7 Byte cipher text + 0 Byte additional authenticated data (AAD) enables me to decrypt $2^{22}$ and $2^{32}$ messages respectively, before having to change the symmetric key.

Since in my application I want to send $2^{32}$ messages before I'll have to change the key, I'll have to use 8 Bytes.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.