Subject: [AVTCORE] Paper on weakness with Integrity in AES-GCM when shortening integrity tag

From: Magnus Westerlund <[email-masked]>
Date: Fri, 25 Mar 2022 11:08:18 +0000

Hi,

A while ago I helped John Mattsson to write a paper that was analysing how a
known weakness in AES-GCM was impacted by RTP. NIST's recommendation at that
time did miss an assumption that does not hold when using RTP/RTCP. With
RTP/RTCP a falsification attempt can in some cases be detected externally,
and that allows one to potentially break the integrity key. 

https://eprint.iacr.org/2015/477.pdf

So there are some things to consider if one are going to consider short
integrity tags for AES-GCM. 

Cheers

Magnus Westerlund