Subject: Re: [CFRG] SRTP: Any work on more cryptoalgorithms?

From: Pierre Karpman <[email-masked]>
Date: Wed, 2 Feb 2022 09:15:28 +0100 (CET)

Hi all, 

Regarding this: 

> Date: Wed, 2 Feb 2022 07:38:52 +0000
> From: Bj?rn Haase <[email-masked]>
> To: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>, Martin Thomson
> <[email-masked]>, "[email-masked]" <[email-masked]>
> Subject: Re: [CFRG] SRTP: Any work on more cryptoalgorithms?
> Message-ID:
> <[email-masked]>

> BTW:

> It is my current knowledge that any universal hashing such as poly1305 or GMAC
> comes with the requirement of having an unshortened full MAC-TAG. So far If I
> saw the need to shorten a MAC-TAG I always only considered HMAC or CBC-style
> MACs (in line e.g. with the paper for CHASKEY) where there is no structure that
> could be exposed as might occur for the universal hashing.
> @Uri could you give a pointer to your paper (and possibly other work) showing
> that shortened TAGs for GMAC and/or poly1305 are actually OK?

I have a silly quesion: is shortening still an issue for polynomial MACs that encrypt the output of the polynomial hash function with something else than a stream cipher (for instance EWCDM ( [ https://eprint.iacr.org/2016/525 | https://eprint.iacr.org/2016/525 ] ) or HaT, Nat etc. ( [ https://tosc.iacr.org/index.php/ToSC/article/view/637 | https://tosc.iacr.org/index.php/ToSC/article/view/637 ] ))? 
(I'm pretty sure that the answer is easy to find in the mentioned papers about shortening GCM, but I don't have time to look at them again right now :( 

-- 
Pierre Karpman 
* 
https://membres-ljk.imag.fr/Pierre.Karpman