Better truncate a CMAC from MSB or LSB I want to truncate an AES128-CMAC from 16 down to 8 bytes length.
Citing RFC, "[...] It is possible to truncate the MAC. The result of the truncation should be taken in most significant bits first order. [...]".

When using CryptoJS to generate such a CMAC over "Hello World" using the key "0xDEADBEEF CAFEBABE DEADBEEF CAFEBABE", this yields: 0x2425a8ff 14cea36d 0a14b3e8 3dbfc68e.


I am not sure, whether my truncated CMAC according to the afore-mentioned definition is either 0x2425a8ff 14cea36d or 0x0a14b3e8 3dbfc68e.
Or in other words: Is 0x24 of the CMAC the most- or least-significant-byte?
How does it affect security when taking the wrong 8 bytes?
Since 8 is half of 16, there are alternative solutions whereby you use both upper and lower bytes but still get 8 bytes out.


XOR adjacent pairs of bytes.
Fold the MAC, XORing 1st and 9th bytes etc.


These techniques are good for when you just can't decide which byte you like best and only take a few lines of code...