Security of 64-bit truncated HMAC of Matrix protocol

Question

I have seen other questions like this one, but I am asking this specifically in the context of Riot messaging and the underlying Matrix protocol.

A basic summary of their message encryption (using keys derived from the key ratcheting Olm primitive, details in the section "Olm authenticated encryption" in the Olm spec) is that messages are encrypted with AES-256-CBC, then authenticated with truncated HMAC-SHA256. Only the first 8 bytes of the HMAC code are sent with the message.

Doesn't this provide only 64-bit protection against MAC forgery? Wouldn't it make more sense to include at least 128 bits so as to match the security of the Curve25519 identity keys underlying the ratchet?

While the 2012 NIST document linked in this answer states that at least 64 bits of HMAC is recommended, is a higher security margin called-for nowadays?

Answer 1

I once had a similar question, and the answer is that: MAC forgery attack targets interacting parties, where as other types of attack such as key-guessing and message decryption targets static messages.

To attack interacting parties with MAC forgery, you can only know if you succeed after they've replied decryption success/failure indication, by which time they would probably have terminated the communication or re-keyed.

On the other hand, if you've enough money to spend on a supercomputer to crack a 64-bit key to decrypt a ciphertext, you can wait as long as you want, and each failure doesn't cause you to start all over again - you can continue where you left.