Using AES-GCM (or AEAD ciphers in general) as a pure MAC without encryption What's the opinion on using an AEAD cipher such as AES-GCM for example as a pure message authentication code (MAC) when only message authentication but not encryption is required.


does it bring any benefits?
does it have any obvious disadvantages?
does it have any security implications?
does it bring any benefits?


Yes, it could. It is likely that e.g. GCM is sped up more than e.g. HMAC. GMAC - the underlying MAC - is using faster operations than HMAC as well, and GMAC is unlikely to be present as MAC in most runtimes. Besides that, it would also require a 128 bit block cipher, so you'd basically have everything you need for an AEAD cipher again.


  does it have any obvious disadvantages?


It could wrong-foot casual readers of the protocol or code. Suddenly they are presented with a cipher rather than a MAC, and that might lead to incorrect conclusions.

It may also well be that there is an additional overhead to take care of verifying a nonce and ciphertext. Although that's a constant overhead that is not related to message size, it may still be significant for small messages.


  does it have any security implications?


Depends on the MAC used and the MAC that it is compared against (and configuration, usage scenario etc.).

EAX mode is an AEAD cipher that uses CMAC for all MAC calculations. It is very likely to be as secure as using CMAC directly.

GMAC security on the other hand is more dependent on the size of the authentication tag compared to e.g. HMAC. It has a substantially lower limits for message count, message size, total message size compared to an algorithm such as HMAC configured with a SHA-2 hash.

Furthermore, a MAC as GMAC or CMAC is limited to 128 bits while e.g. HMAC can output 256 bits or 512 bits. Not that you're likely to ever need that amount of security for a MAC, but it can weigh in none-the-less.

Key reuse for two ciphers can negate all security and even lead to leaking the MAC key, something that is less likely an issue for a cipher + HMAC.