Why length of only 32-bits in 128-EIA3 MAC?

Typically by today's standards, MACs are of greater length than 32-bits. Having only
32 bits allows birthday-paradox comments like this
(Although the comment there relies on prohibited assumption of the use of one IV twice)

So, why only 32-bit MAC?

koko wrote:
Typically by today's standards, MACs are of greater length than 32-bits. Having only
32 bits allows birthday-paradox comments like this
(Although the comment there relies on prohibited assumption of the use of one IV twice)

So, why only 32-bit MAC?

The MAC size is part of the overall LTE standard, and not specific to the ZUC-based algorithm. It's the same for all of 128-EIA1, 128-EIA2 and 128-EIA3.

Larger MACs mean that messages occupy more bandwidth and take longer to send - i.e. they come at a cost. In the LTE context, where the secret key used for integrity protection does not have a very long lifetime, a 32-bit MAC seems sufficient to give good protection against realistic threats.