Secure Programming Cookbook for C and C++

6.17. Using Smaller MAC Tags

Problem

You want to trade off security for smaller authentication tags.

Solution

Truncate the least significant bytes of the MAC, but make sure to retain adequate security.

Discussion

Normal software environments should not have a need for smaller MACs because space is not at a premium. However, if you’re working in a space-constrained embedded environment, it’s acceptable to truncate MAC tags if space is a requirement. Note that doing so will not reduce computation costs. In addition, keep in mind that security goes down as the tag size decreases, particularly if you are not using a nonce (or are using a small nonce).