Subject: [Cfrg] Summary -- Short Authentication Tags in AES-128-CCM

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 31 Jul 2015 18:36:30 +0200

Thanks a lot for the feedback.

My conclusion from the feedback was the following:

* There is no problem with the use of short authentication tags in
AES-128-CCM. As such, I don't see a reason to change the recommendation.

* David suggested to include additional text about the implications of
the use of these short authentication tags into the IoT DTLS/TLS profile
document. Various others provided pointers to relevant documents. I will
think about adding appropriate text.

* Several persons suggested additional algorithms/ciphersuites that may
also be well suited for the IoT space. I am not going to add new
algorithms at this late stage in the process (and given the current
deployment situation of AES-CCM in the IoT world). However, I have
already pointed out in the draft that there will always be the need to
support other algorithms in the future (crypto agility). While this may
be difficult in many cases where the algorithm implementation is in
hardware. For other cases, this may, however, not be a problem and a
software update mechanism would allow switching to a more efficient/more
secure algorithm over time.

Ciao
Hannes