Re: [Cfrg] Short Authentication Tags in AES-128-CCM

[Paul Lambert <[e-mail]>]

Another option that has been picked up by byte-senstive standards groups
is to use AES-SIV.  The IV and integrity check are combined saving overall
encapsulation size.  Also, AES-SIV has a significant advantage that it
does not require nonce/IV uniqueness.  Setup is simplified for a pair-wise
links.  Broadcast/multicast is viable without complex nonce coordination.

AES-128-SIV is a much better option for small messages than tweaking
AES-128-CCM.  

Paul



On 7/22/15, 3:20 AM, "Cfrg on behalf of Hannes Tschofenig"
<[e-mail] on behalf of [e-mail]> wrote:

>Hi all,
>
>in the Internet of Things context there has been some excitement to use
>short authentication tags with AES-128-CCM. With short range, low power
>radio technologies shorter frame sizes raise concerns about the number
>of bytes that are available to the application layer.
>
>The DTLS/TLS profile for IoT document <draft-ietf-dice-profile>
>therefore recommends the TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 ciphersuite,
>following what the CoAP protocol and also Zigbee IP suggest.
>
>When Stephen did a review of draft-ietf-dice-profile-13 he suggested to
>rather focus on AES-128-CCM with the full-length authentication tag
>instead. He motivates his suggestion based on the decision of the SRTP
>guys to move away from short authentication tags used with AES-GCM-128.
>Of course, AES-CCM and AES-GCM are different and attacks against AES-GCM
>with short authentication tags have been published.
>
>My question to this group is:
>
> * Are you aware of attacks against the AES-128-CCM-8?
> * Are there concerns with the use of short authentication tags, as we
>recommend for the IoT context? (Needless to say that there is a tradeoff
>between rekeying and the number of bits the tag has.)
>
>Ciao
>Hannes
>
>