Subject: [AVTCORE] Short Authentication tagsd in AES-GCM for SRTP

From: "Igoe, Kevin M." <[email-masked]>
Date: Fri, 19 Jun 2015 11:39:27 +0000

After discussions with Magnus, we have decided it would be prudent to remove the option of short tags
 (8-octet) from AES-GCM.  Here is the reasoning:

  -  Following Appendix C of NIST 38-D us that using 8-octet tags with  2^k octet long packets constrains
    the  number of packets that can be sent before the key is changed 2^T  where T = (109-3k)/2.  
  -  Magnus points out that IPv6 will conceivably allow packets up to 2^32 octets in length.

Putting these two observations together we find that  2^32 octets long  IPv6 packets, would only allow 
2^6.5 = 90.5 packets/key.  Not at all practical.
   
I feel that pursuing the use of short tags with AES-GCM in SRTP is a losing proposition and wish to remove 
them from the ID, only allowing the use of a full 16-bytes tag.  Any objections?