Subject: Re: [TLS] AAED ciphers: AES-GCM vs AES-EAX/AES-CCM: a meta-analysis

From: Peter Gutmann <[email-masked]>
Date: Tue, 6 Jan 2015 11:37:13 +0000

"Paterson, Kenny" <[email-masked]> writes:

>It's good that nothing supports the truncated-MAC extension, because, in
>combination with TLS's support for variable length padding, it introduces a
>security vulnerability.

Ooh, good to know, thanks!  The truncated-MAC extension is actually kind of
silly, there's only one size allowed, 80 bits, which isn't really useful (you
save all of 48 bits for a 128-bit MAC) while for ridiculous-sized MACs like
HMAC-SHA256 and HMAC-SHA512 where you would want to truncate, say to 128 bits,
you can't do it.

>This is not an issue for any of the cihersuites proposed above, but it's
>something to be kept in mind when considering "exotic" ciphersuites.

Actually it does affect AES, since you can only truncate to 80 bits.

Peter.