Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications

["Gueron, Shay" <[e-mail]>]

Hi Aaron,

Thanks for the comment, but I believe your conclusion is not correct.

AES-GCM-SIV (128/256 bit key) which is proposed for CFRG is a fully 
nonce misuse resistant authenticated encryption scheme.

This means the following: repeating a nonce will not leak any 
information except if the same nonce and the same message is encrypted. 
In that case, an adversary could only know that the two identical 
message were encrypted (this cannot be avoided in any deterministic 
scheme).

Of course, there are limits to the number of times messaged can be 
encrypted with the same key. The security margins of the CCS2015 paper 
(original scheme) were proven there.

The CFRG submission extends the number of times that a single key 
(either 128 or 256 bits) can be used - and gets better bounds - at the 
cost of extra key expansion, as specified (we will publish the improved 
bounds).

However, if a user chooses to use the scheme to send many (e.g., ~2^48) 
messages while always repeating the same nonce, then AES-GCM-SIV simply 
reduces to the GCM-SIV of the CCS2015 paper (and the synthetic IV's 
will, at high probability, collide). This is inevitable under such a 
"nonce abuse" scenario. Basically, this case would behave similarly to 
AES-GCM with a random 96-bit nonce, used ~2^48 with the same key.

What else can be expected?

I hope this clarifies the situation.

Thanks, Shay

------ Original Message ------
From: "Aaron Zauner" <[e-mail]>
To:
Cc: "Yehuda Lindell" <[e-mail]>; "[e-mail]" 
<[e-mail]>; "Adam Langley" <[e-mail]>
Sent: 4/15/2016 8:48:07 AM
Subject: Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant 
Authenticated Encryption" as a CFRG document ---- Some clarifications

>Hi,
>
>Went through past discussion on the proposal, the draft and (also) 
>noticed the security considerations section and Adam's reply over here: 
>https://www.ietf.org/mail-archive/web/cfrg/current/msg08030.html
>
>So I think it's worth noting in the document that this proposal isn't 
>"as" nonce misuse resistant to the extent that some people may assume 
>it is by the title/abstract. i.e. GCM-SIV speaks of "Fully nonce misuse 
>resistance" while AES-GCM-SIV uses the term "Nonce misuse resistance" - 
>it may be well worth going into more detail in the draft on the matter 
>and clarifying. Please correct me if I'm completely off-course here.
>
>Aaron