When used as a MAC, 256-bit tags are recommended. But in interactive protocols, 128 bits may be acceptable.