In the Dutch "IT Security Guidelines for Transport Layer Security (TLS)" the ciphersuites using AES-128-CCM_8 (i.e. CCM with a 64 bit authentication tag) are considered "insufficient".
This is the only reason given:
AES-CCM_8 is a variant of AES-CCM with a truncated authentication tag, which has a lower security equivalent for integrity protection.
Now I can see that changing messages would only give you 32 bit of security for the MAC construction due to the birthday attack. However, if the messages are unique for a given key and given that the connection is lost whenever the MAC is invalid, I can only assume that the full 64 bit security is still in effect. The verification oracle required for such an attack seems missing.
Now 64 bit security isn't much, but given that there are three security levels: good, sufficient and insufficient, I wonder if "sufficient" would not be better fit. Do note that CCM security with a full authentication tag is considered "sufficient" in a side-note within the same document.
Are there any attacks that I'm overlooking or would the 64 bit security strength be enough to warrant the "insufficient" security level?
