Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications

[Adam Langley <[e-mail]>]

On Fri, Apr 15, 2016 at 6:00 PM, Michael StJohns <[e-mail]> wrote:
> That's not exactly what I mean/meant.  In TLS, the same message (record,
> etc) sent under the same key and IV/NONCE (as produced by the TLS PRF/KDF
> functions or produced randomly) will provide different ciphertext based on
> the fact that the record counter changes with each message.  That counter
> doesn't necessarily have to be part of the authenticated data in an AEAD
> cipher as the nonce formation is somewhat external to processing (with the
> exception of the block counter).
>
> To get the equivalent behavior for AES-GCM-SIV, you need to ensure there is
> some sort of per-message unique mixin (unique within the association
> duration at least) that causes the tag to be different which causes the
> nonce to be different.

That's correct and, in the case of TLS, I'd suggest that the sequence
number be used as the nonce in order to make sure that equal messages
don't produce equal ciphertexts. Although, to be clear, I'm not
suggesting that AES-GCM-SIV be used in TLS or in any situation where a
counter nonce is easy. Transport security is generally a situation
where a single sender can just use a counter and, in those cases,
AES-GCM is better.

But there are situations where nonce management is a problem (i.e.
where there are multiple machines encrypting with a single key) and,
for that, I think AES-GCM-SIV is pretty attractive because one can
reasonably use a random nonce.


Cheers

AGL