Re: [CFRG] HPKE and Key Wrapping

[Taylor R Campbell <[e-mail]>]

> Date: Wed, 30 Mar 2022 08:51:44 +0000
> From: John Mattsson <john.mattsson=[e-mail]>
> 
> How does AES-SIV (RFC 5297) compare with AES-GCM-SIV (RFC 8452)? Do
> we need both algorithms in the future? Does AES-GCM-SIV with a fixed
> nonce provide the same properties as nonce-less AES-SIV or is there
> a difference?

There is a fairly substantial difference.  In the Daence paper I drew
a table of advantage bounds for AES-SIV and AES-GCM-SIV, using the
best formulae I could find (with the function/permutation-switching
lemma of https://cr.yp.to/papers.html#permutations that gives better
bounds than the conventional q*(q - 1)/2 used in most papers):

https://eprint.iacr.org/2020/067.pdf#page=5

Smaller advantage bounds, i.e., larger values of n in the 2^-n terms,
are better.  1 means no advantage bound has been proven at all for
these parameters.

This table was computed using the logic at

https://github.com/riastradh/daence/blob/master/adv.py

which cites the sources in the literature I used for the formulae.
You can reuse the same logic to recompute bounds for different message
sizes/numbers if what you're looking for isn't in the table, of
course.

It may be worth noting that the security advertisment in RFC 8452 for
AES-GCM-SIV explicitly discourages nonce reuse even between different
users (different keys), which means you should even avoid the policy
of sequential message numbers that, e.g., TLS 1.3 uses with AES-GCM to
rule out a class of attacks:

https://datatracker.ietf.org/doc/html/rfc8452#page-12

The bottom line is that AES-GCM-SIV is designed for randomized nonces,
with some level of protection if your RNG fails.  In contrast, AES-SIV
is designed for security without nonces at all, and is particularly
well-suited to key-wrap, which should come as no surprise since that's
what it was designed for originally, as sung in Appendix F of:

https://web.cs.ucdavis.edu/~rogaway/papers/keywrap.html