Security of CCM in TLS, in comparison to GCM, SHA or SHA2 for the digest I've been looking into TLS cipher suites of OpenSSL and mbedTLS (previously called PolarSSL) and noticed that mbedTLS supports the CCM mode of operation (See list here), whereas OpenSSL does not. If I understand this correctly, this provides authenticated encryption and therefore covers the message hashing in TLS, like GCM.

Looking up CCM, I couldn't find much information on its security. How does it compare to GCM or SHA1/2?



Edit:

mbedTLS TLS cipher suites with CCM:


TLS-RSA-WITH-AES-128-CCM
TLS-RSA-WITH-AES-256-CCM
TLS-RSA-WITH-AES-128-CCM-8
TLS-RSA-WITH-AES-256-CCM-8
TLS-DHE-RSA-WITH-AES-128-CCM
TLS-DHE-RSA-WITH-AES-256-CCM
TLS-DHE-RSA-WITH-AES-128-CCM-8
TLS-DHE-RSA-WITH-AES-256-CCM-8
TLS-ECDHE-ECDSA-WITH-AES-128-CCM
TLS-ECDHE-ECDSA-WITH-AES-256-CCM
TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8
TLS-ECDHE-ECDSA-WITH-AES-256-CCM-8
TLS-PSK-WITH-AES-128-CCM
TLS-PSK-WITH-AES-256-CCM
TLS-PSK-WITH-AES-128-CCM-8
TLS-PSK-WITH-AES-256-CCM-8
TLS-DHE-PSK-WITH-AES-128-CCM
TLS-DHE-PSK-WITH-AES-256-CCM
TLS-DHE-PSK-WITH-AES-128-CCM-8
TLS-DHE-PSK-WITH-AES-256-CCM-8
GCM and CCM are both basically fine as far as typical TLS use goes, although there is a litany of caveats for them:


Anything involving AES is likely to be vulnerable to timing side channel attacks, if you cannot guarantee that you are using hardware implementations of AES.  (Portable C code cannot.)
GCM is also likely to be vulnerable to different timing side channel attacks, if you cannot guarantee that you are using hardware Galois field arithmetic.  (Portable C code cannot.)
The length of the authentication tag directly affects security: the GCM and CCM suites use 128-bit tags, but the CCM-8 suites use 64-bit tags, so they cannot get better than a 64-bit security level against forgery.
For both GCM and CCM, the security contract requires that the key never be reused with a nonce.  If they were integrated into TLS sensibly, the protocol would mandate the use of sequential nonces, so that there is only one possible choice of nonce for each message and if a peer chooses any other nonce it will noisily fail to interoperate.  TLS 1.3 will do this, but when GCM was first introduced for TLS, it was foolishly designed to allow the peers to choose nonces however they like, to hilarious effect, and CCM in TLS parroted the mistake.


You can't fix any of these problems except by picking an entirely different cipher suite, but you can check whether these are problems for mbedTLS or your particular deployment of it—make sure mbedTLS uses sequential nonces, for example, and take a close look at how it computes AES and GHASH.

Or, if mbedTLS and your clients support it, just always use ChaCha20/Poly1305 cipher suites instead, which have none of these issues.