1
$\begingroup$

I have messages with the following fixed lengths:

  • 4 byte
  • 8 byte
  • 16 byte

I want to encrypted them and prevent modification by appending an authentication tag using a MAC algorithm of my choosing (e.g. using Encrypt-then-Mac schema). Additionally I want the cipher output message to be as short as possible.

Let's say the normal MAC output size would be 16 byte (e.g CMAC with AES). Can I truncate the MAC with a short message like 4 byte to get similar security assurances?

According to various NIST standards, minimum lengths of MAC from 64 bit (CMAC) to 96 bit (GMAC) are recommended.

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ Tags not based on hashes aren't always safe to truncate. Besides that, if you do use one safe to truncate, then it's really a question of threat model. NIST is talking about generic algorithms for use in a variety of protocols, where a certain lowest bar is good enough for the majority of users. Sometimes it may still be safe to go below that limit if you understand your threat model. Every bit removed from the tag makes it twice as easy as before to spoof a message. Is 1/2^32 risk per message good enough for you? $\endgroup$
    – Natanael
    Commented May 5, 2019 at 23:33
  • 1
    $\begingroup$ What forgery probability can you tolerate? What is your budget? This should be measured in bytes, cycles, or joules—if your budget isn't that specific, don't mess with the standard 16-byte authenticators like in AES-GCM or crypto_secretbox_xsalsa20poly1305. $\endgroup$
    – Squeamish Ossifrage
    Commented May 16, 2019 at 23:59

1 Answer 1

Reset to default
1
$\begingroup$

Cryptographic strength of an authentication tag strongly depends on the tag size and you shouldn't use a tag less than 64-bits for any application. 64-bits is really the minimum you should use.

Such a short tag is acceptable for online protocols, where the intent is just to authenticate a packet that has been received. Since 64-bits will not be collusion resistant, previous tags will be reused before ~2^30 messages. To mitigate this, you might need to rotate key frequently.

You can consider using SipHash function which is optimized for short inputs and has an output of 64-bits.

https://eprint.iacr.org/2012/351

Improve this answer
$\endgroup$
1
  • $\begingroup$ Tag collisions don't matter. $\endgroup$
    – Paul Crowley
    Commented Mar 16, 2021 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.