In the Dutch "IT Security Guidelines for Transport Layer Security (TLS)" the ciphersuites using AES-128-CCM_8 (i.e. CCM with a 64 bit authentication tag) are considered "insufficient".

This is the only reason given:

AES-CCM_8 is a variant of AES-CCM with a truncated authentication tag, which has a lower security equivalent for integrity protection.

Now I can see that changing messages would only give you 32 bit of security for the MAC construction due to the birthday attack. However, if the messages are unique for a given key and given that the connection is lost whenever the MAC is invalid, I can only assume that the full 64 bit security is still in effect. The verification oracle required for such an attack seems missing.

Now 64 bit security isn't much, but given that there are three security levels: good, sufficient and insufficient, I wonder if "sufficient" would not be better fit. Do note that CCM security with a full authentication tag is considered "sufficient" in a side-note within the same document.

Are there any attacks that I'm overlooking or would the 64 bit security strength be enough to warrant the "insufficient" security level?

  • $\begingroup$ BTW a very readable document with OK recommendations, could definitely act as a reference for anybody searching for good TLS requirements in my opinion. $\endgroup$
    – Maarten Bodewes
    Commented Aug 13, 2020 at 13:45
  • $\begingroup$ "However, if the messages are unique for a given key" Does that guarantee hold for all messages and uses? If not, and given that it's somewhat of a judgement call on their part, I can certainly see not wanting to consider it as "sufficient". $\endgroup$ Commented Aug 13, 2020 at 18:23
  • 1
    $\begingroup$ @SAIPeregrinus TLS uses sequence numbers (64 bit uint) for each state (one for sending and one for receiving, using separate session keys), so yeah, I guess that this must be the case. $\endgroup$
    – Maarten Bodewes
    Commented Aug 13, 2020 at 21:10
  • $\begingroup$ I think so too, for a conforming implementation. The question is if any extant implementations screw this up, or have in the past. If it's an easy failure point it makes sense to downgrade the scheme, even though it's not wholly the scheme's fault. I'm not aware of this being the case, just trying to guess their reasoning. $\endgroup$ Commented Aug 14, 2020 at 1:00
  • 1
    $\begingroup$ Yeah, I guess in the end I'll just have to ask and answer myself. However, I'm more and more gravitating towards: 64 is a lot smaller than 128, so it's not secure. $\endgroup$
    – Maarten Bodewes
    Commented Aug 14, 2020 at 11:46


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.