Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac based authentication only service via using only Gmac instead of complete Gcm.
So I wondered if GMAC could or not be proposed as a serious / valid standalone Mac mode of operation when compared to well-known Hmac or Cmac.
I fear the answer is NO for at least the two following reasons but as not being a crypto expert I would be interested to get more pertinent advices:
first GMAC requires use of an iv which is not the case for other Mac modes; this induces additional overhead on the messages to carry associated iv (subset)
then GMAC is known to fail (ghash key disclosure) if iv uniqueness constraint is not strictly respected.Hmac or Cmac do not know that kind of risk as not using any iv
Is it correct or am I too much pessimistic about GMAC in regard with robustness & performances of Hmac or Cmac widely recognised modes ? .