[Dtls-iot] Replacing TLS_PSK_WITH_AES_128_CCM_8 with TLS_PSK_WITH_AES_128_CCM

[Hannes Tschofenig <[e-mail]>]

Stephen wrote:

(1) 6.1: Is TLS_PSK_WITH_AES_128_CCM_8 still ok for CoAP? We're
discussing taking all the _8 ones out for SRTP, i.e., from
[draft-ietf-avtcore-srtp-aes-gcm] because of the 8 octet tag being too
short. I'd need to go check if the same issues apply here, but maybe they
don't. What do we think? If this applies to any of the ciphersuites
here, it presumably applies to all so I wanted to check just in case.
(Kevin Igoe and Magnus Westerlund are involved in that SRTP discussion
in case it helps.)

[Hannes] So far there has been no issue reported with the use of shorter
message authentication codes (also called truncated authentication
tags). With AES_128_CCM_8 the MAC is 8 octets long whereas with
AES_128_CCM it would be 16 octets long. While this does not help to
improve performance it reduces the bits transmitted over the wire.

The summary of why the authors of <draft-ietf-avtcore-srtp-aes-gcm-17>
suddenly prefer full authentication tags over the truncated version is
from the write-up found in <draft-ietf-avtcore-srtp-aes-gcm-17> not
really understandable. I would feel more comfortable if there is a
reference to an analysis given somewhere why this is now a problem and
wasn't one not too long ago.

My recommendation: Keep text as is.

Thoughts about this issue from the rest of the working group?