Re: [Cfrg] CFRG Review Panel - Draft Charter

[Aaron Zauner <[e-mail]>]

> On 11 May 2016, at 03:14, Yoav Nir <[e-mail]> wrote:
> But nonce reuse doesn’t happen in many of our favorite protocols: SSH, TLS, IPsec, S/Mime, so AES-GCM-SIV is not a good algorithm for any of those, or at least no better than regular AES-GCM. I’d like a review to tell what kind of protocols or use cases might benefit from an algorithm with this property, such as multicast IPsec with multiple senders or group unicast IPsec such as Cisco’s GET-VPN.

Full disclosure, since this is somewhat public by now anyways: It does happen in TLS. The chairs received an abstract on a soon-to-be published paper in the matter late yesterday as did Stephen Farrell (as you're aware you're not affected :)). One of the chairs has a full working copy/author version including PoC code for our attack.

To that extent may I ask the following question: with proposals like AES-GCM-SIV, should I press cryptographers that initially submitted to CAESAR to submit drafts to CFRG, fill up everyones pipeline and get CFRG into dead-lock? How do we deal with that problem? How's CFRG better/different for IETF than a proper crypto competition (even if some take ages, or seem to be a never ending story).

Aaron