Re: [Cfrg] Short Authentication Tags in AES-128-CCM

[John Mattsson <[e-mail]>]

Hi,

 
Avtcore/IESG decided to not standardize CCM_8 and GCM_8, but for different
reasons. CCM (all tag lengths) was removed as Stephen wanted to limit the
number of algorithms, and nobody expressed any imminent plans to implement
SRTP with CCM. GCM_8 was removed because of the theoretical weaknesses
with GCM and short tags (summarized in https://eprint.iacr.org/2015/477)
and their applicability to SRTP
(https://mailarchive.ietf.org/arch/msg/avt/cKHmfai2SISd7itL_NlgXRJUPow).
 

I am not aware of any weaknesses with CCM_8 that depends on the tag
length, except the general weakness that the forgery probability is the
expected 2^-64. In his recent evaluation for Cryptec
(http://www.cryptrec.go.jp/estimation/techrep_id2012_2.pdf), Rogaway
states as one of the conclusions “CCM achieves good provable-security
results, even with truncated tags” Given the constrained radio
technologies targeted by dice, I think that 64-bit tags are a reasonable
tradeoff.

Looking at the dice profile, I am more concerned with the lack of forward
security in TLS_PSK_WITH_AES_128_CCM_8 and the fact that this cipher suite
will likely be forbidden in DTLS 1.3 (as far as I understand). I would
recommend changing this to ECDHE_PSK, or convincing the TLS wg to continue
supporting PSK. Standardizing a new profile that will not work with DTLS
1.3 would be strange.

 
Cheers,
John
 



On 22/07/15 05:20, "Hannes Tschofenig" <[e-mail]> wrote:

>Hi all,
>
>in the Internet of Things context there has been some excitement to use
>short authentication tags with AES-128-CCM. With short range, low power
>radio technologies shorter frame sizes raise concerns about the number
>of bytes that are available to the application layer.
>
>The DTLS/TLS profile for IoT document <draft-ietf-dice-profile>
>therefore recommends the TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 ciphersuite,
>following what the CoAP protocol and also Zigbee IP suggest.
>
>When Stephen did a review of draft-ietf-dice-profile-13 he suggested to
>rather focus on AES-128-CCM with the full-length authentication tag
>instead. He motivates his suggestion based on the decision of the SRTP
>guys to move away from short authentication tags used with AES-GCM-128.
>Of course, AES-CCM and AES-GCM are different and attacks against AES-GCM
>with short authentication tags have been published.
>
>My question to this group is:
>
> * Are you aware of attacks against the AES-128-CCM-8?
> * Are there concerns with the use of short authentication tags, as we
>recommend for the IoT context? (Needless to say that there is a tradeoff
>between rekeying and the number of bits the tag has.)
>
>Ciao
>Hannes
>
>