Re: [Cfrg] Call for adoption for draft-wood-cfrg-aead-limits

   Hello,

   I very much support adoption of this draft.

   But as I mentioned on the virtual meeting I'd like to see some 
analysis on
the impact that the amount of AAD has on the integrity (and if 
applicable, the
encryption) bound. I know this draft is motivated by the use of AEAD 
algorithms
with QUIC and TLS where the AAD will be a fraction of the ciphertext, but it
should address other uses of AEAD algorithms that may do things differently.

   regards,

   Dan

On 7/22/20 8:48 PM, Martin Thomson wrote:
> On Thu, Jul 23, 2020, at 05:32, Mihir Bellare wrote:
>> A question about this. Shouldn't the integrity bound of 5.1.2 also
>> depend on the number q of encryption attempts? Comparing to Eq. (15) of
>> reference [GCMProofs], it seems the draft has set q=0. I was wondering
>> what is the reason for that choice.
> q as defined in the draft is the number of encryption attempts, so yes, q is indeed relevant.  In the analysis we did for QUIC there were cases where this resulted in a limited that affected q as much as it did v (or q' as used in the paper).
>
> The authors have been discussing moving to an analysis based on https://eprint.iacr.org/2018/993 instead.  Assuming that goes ahead, we'll have a different result to report there.
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg