Re: [Cfrg] Short Authentication Tags in AES-128-CCM

Hi,

For short tags, it makes sense to consider algorithms where ciphertext modifications result in randomized plaintexts. In effect, the tag can be shorter, or the same length tag yields higher security compared to a counter mode based algorithm. For counter mode based algorithms, ciphertexts can be predictively modified, so a successful forgery can be much more damaging.

CMCC (http://eprint.iacr.org/2013/269) is one such algorithm (also see the Caesar competition). CMCC also handles plaintexts shorter than the block length without additional padding and is nonce misuse resistant.

Jonathan

--------------------------------------------
On Wed, 7/22/15, Hannes Tschofenig <hannes.tschofenig@gmx.net> wrote:

 Subject: [Cfrg] Short Authentication Tags in AES-128-CCM
 To: "cfrg@irtf.org" <cfrg@irtf.org>
 Date: Wednesday, July 22, 2015, 3:20 AM

 Hi all,

 in the Internet of Things context there has been some
 excitement to use
 short authentication tags with AES-128-CCM. With short
 range, low power
 radio technologies shorter frame sizes raise concerns about
 the number
 of bytes that are available to the application layer.

 The DTLS/TLS profile for IoT document
 <draft-ietf-dice-profile>
 therefore recommends the TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8
 ciphersuite,
 following what the CoAP protocol and also Zigbee IP
 suggest.

 When Stephen did a review of draft-ietf-dice-profile-13 he
 suggested to
 rather focus on AES-128-CCM with the full-length
 authentication tag
 instead. He motivates his suggestion based on the decision
 of the SRTP
 guys to move away from short authentication tags used with
 AES-GCM-128.
 Of course, AES-CCM and AES-GCM are different and attacks
 against AES-GCM
 with short authentication tags have been published.

 My question to this group is:

  * Are you aware of attacks against the AES-128-CCM-8?
  * Are there concerns with the use of short authentication
 tags, as we
 recommend for the IoT context? (Needless to say that there
 is a tradeoff
 between rekeying and the number of bits the tag has.)

 Ciao
 Hannes

 -----Inline Attachment Follows-----

 _______________________________________________
 Cfrg mailing list
 Cfrg@irtf.org
 http://www.irtf.org/mailman/listinfo/cfrg