Has GMAC mode a future outside GCM? Once gcm has been implemented for providing both encryption &amp; authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac based authentication only service via using only Gmac instead of complete Gcm.

So I wondered if GMAC could or not be proposed as a serious / valid standalone Mac mode of operation when compared to well-known  Hmac or Cmac.

I fear the answer is NO for at least the two following reasons but as not being a crypto expert I would be interested to get more pertinent advices:


first GMAC requires use of an iv which is not the case for other Mac modes; this induces additional overhead on the messages to carry associated iv (subset)
then GMAC is known to fail (ghash key disclosure) if iv uniqueness constraint is not strictly respected.Hmac or Cmac do not know that kind of risk as not using any iv


Is it correct or am I too much pessimistic about GMAC in regard with robustness &amp; performances of Hmac or Cmac widely recognised modes ?
.
To answer your question: yes, GMAC does have niche applications where it performs better than either HMAC or CMAC; however it might not make sense for you.

First of all, you are correct in that GMAC requires an IV, and bad things happen if a particular IV value is reused; this rather rules out GMAC for some applications, and is a cost even for applications that can live with it.

So, is there any application for GMAC where makes it worth paying this cost?  Well, yes, there is; in hardware, you can do GMAC considerably faster than either HMAC or CMAC.

Suppose you have a stream of data running at 40,000,000,000 bits per second (that's 40Gbps) at we need to integrity-check.  Even with aggressive hardware, neither HMAC nor CMAC can deal with data at that rate; GMAC can.

Now, that's very much a niche application; I rather suspect you'll never run into that yourself.  I believe you're really asking "does GMAC make sense for what I'm doing"

Well, I can't give you a direct answer to that (partially because I'm not exactly certain what it is you're doing).  However, it would appear to me that the only thing that GMAC buys you in your scenario is simplicity (you have a GCM implementation; GMAC is GCM with everything going into the AAD) and consistency (that way, the encryption and authentication-only cases are handled similarly). I cannot tell whether these advantages are worth the costs of GMAC, or whether you're better off tossing in (for example) an HMAC implementation to handle the authentication-only case.