[AVTCORE] FW: I-D Action: draft-mattsson-cfrg-aes-gcm-sst-06.txt

[John Mattsson <[e-mail]>]

Hi,

The -06 draft of “Galois Counter Mode with Secure Short Tags (GCM-SST)” includes references to the paper “Generic Security of GCM-SST” by Akiko Inoue, Ashwin Jha, Bart Mennink, and Kazuhiko Minematsu, which has been accepted to ACNS 2025 and was published on the IACR ePrint archive today. https://eprint.iacr.org/2024/1928.

Key contributions of Inoue et al. include:


  *   The authors prove that GCM-SST achieves security within the nonce-misuse resilience model of Ashur et al. (CRYPTO 2017). This ensures that even if nonces are reused, evaluations of GCM-SST for fresh nonces remain secure.
  *   They show that masking in GCM-SST can be replaced by non-zero injecting padding of the ciphertext. This optimization reduces the number of AES invocations for approximately 94% of plaintext lengths, improving performance.
  *   The paper describes a universal forgery attack that improves the complexity of Lindell's attack. However, note that this attack is only relevant if GCM-SST is used without replay protection—a scenario explicitly prohibited since version -04.
  *   Provides nice drawings comparing the bounds of GCM and GCM-SST, which demonstrate that GCM-SST has significantly reduced the security degradation for truncated tags (the dominating authentication portion improves from 2^t/ℓ to 2^t). See Fig. 3 of the paper.
We will evaluate and consider the non-zero injecting padding optimization for a later version of the draft.
Cheers,
John

On 2024-11-29, 19:08, "[e-mail]" <[e-mail]> wrote:
Internet-Draft draft-mattsson-cfrg-aes-gcm-sst-06.txt is now available.

   Title:   Galois Counter Mode with Secure Short Tags (GCM-SST)
   Authors: Matthew Campagna
            Alexander Maximov
            John Preuß Mattsson
   Name:    draft-mattsson-cfrg-aes-gcm-sst-06.txt
   Pages:   23
   Dates:   2024-11-29

Abstract:

   This document defines the Galois Counter Mode with Secure Short Tags
   (GCM-SST) Authenticated Encryption with Associated Data (AEAD)
   algorithm.  GCM-SST can be used with any keystream generator, not
   just 128-bit block ciphers.  The main differences from GCM are the
   use of an additional subkey Q, the derivation of fresh subkeys H and
   Q for each nonce, and the replacement of the GHASH function with the
   POLYVAL function from AES-GCM-SIV.  This enables truncated tags with
   near-ideal forgery probabilities and significantly decreases the
   probability of multiple forgeries.  GCM-SST is designed for unicast
   security protocols with replay protection and addresses the strong
   industry demand for fast encryption with secure short tags.  This
   document registers several instances of GCM-SST using Advanced
   Encryption Standard (AES) and Rijndael-256-256.

The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-mattsson-cfrg-aes-gcm-sst/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-mattsson-cfrg-aes-gcm-sst-06.html

A diff from the previous version is available at:
https://author-tools.ietf.org/iddiff?url2=draft-mattsson-cfrg-aes-gcm-sst-06

Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts