Re: [TLS] AAED ciphers: AES-GCM vs AES-EAX/AES-CCM: a meta-analysis

[Manuel Pégourié-Gonnard <[e-mail]>]

On 06/01/2015 11:35, Paterson, Kenny wrote:
> On 06/01/2015 10:27, "Peter Gutmann" <[e-mail]> wrote:
> 
>> The MAC is whatever is negotiated for the session, and if you want a
>> shorter
>> one you can send the truncated-MAC extension (which, however, nothing
>> supports
>> AFAIK).  
> 
For some definition of nothing, which includes CyaSSL, MatrixSSL, PolarSSL and
apparently RSA BSAFE too:
https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations#Extensions

(FWIW, in PolarSSL we're going to disable it by default in the next major version.)

> It's good that nothing supports the truncated-MAC extension, because, in
> combination with TLS's support for variable length padding, it introduces
> a security vulnerability. See:
> 
> http://www.isg.rhul.ac.uk/~kp/mee-comp.pdf
> 
> 
> which shows that if the tag size (MAC length) is shorter than the CBC-mode
> block size, then there's a distinguishing attack that can tell the
> difference between the encryption of a short message and a longer message
> (even though both are padded to the same size before encryption).
> 
But if one does not expect any length hiding, is there still a problem with
truncated MACs?

Manuel.