Re: [Cfrg] AES-SIV versus AES-GCM for Encrypted Key Data

[Russ Housley <[e-mail]>]

Stephen:

>>> On 17/05/16 14:50, Russ Housley wrote:
>>>> I do not speak for NSA.  However, NSA only uses algorithms and
>>>> modes that are FIPS-approved.  AES-SIV does not meet that
>>>> requirement.  If that happens in the future, then the direction
>>>> might change.
>>> 
>>> I don't speak for anyone:-)
>>> 
>>> I strongly believe that holding off from making improvements of the
>>> basis of FIPS approval/certification is a really bad idea. If a
>>> case can be made that the suggested change is less good or no
>>> better than the FIPS approved/certified thing, then that is a
>>> debate worth having, but waving the FIPS flag is not itself IMO a
>>> good counter argument to a claim that some change is an
>>> improvement.
>> 
>> Your comments are beyond the context of the question at the front of
>> this thread.
>> 
>> This thread was about a particular set of IEEE 802.11 ballot
>> comments: 
>> https://mentor.ieee.org/802.11/dcn/16/11-16-0596-01-00ai-more-counters.docx
> 
> Actually, I think my comments are relevant.
> 
> All IMO of course, but if IEEE decided to use AES-GCM and not
> SIV on sound technical bases, that's fine. If however, IEEE
> decided to use AES-GCM and not SIV solely or mostly due to the
> FIPS argument, that's bad.
> 
> Earlier up-thread, the comment was made that FIPS approval is
> a reason to go with GCM here and not SIV. I'm saying that's a
> bad argument unless both schemes are otherwise the same in terms
> of interesting technical properties.
> 
>> 
>> 
>>> And I'd be disappointed if an international organisation of any
>>> kind did accept that kind of flag waving.
>> 
>> I guess that you are disappointed.  I understand that AES-SIV was
>> selected over AES-GCM.
> 
> That's the opposite of what Peter's submission (in the URL above)
> is suggesting. Has that been decided or is it still in play? Peter's
> suggested change back to GCM is dated May 15th so I guessed that that
> is still in progress.

My understanding is that the task group rejected the proposed changes yesterday.

Russ