Re: [Cfrg] SHA256 based AEAD construction

Tony Arcieri <> Mon, 18 February 2019 23:33 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id DCC921310AF for <>; Mon, 18 Feb 2019 15:33:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id Le5K6KcJ_phD for <>; Mon, 18 Feb 2019 15:33:25 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:4864:20::32b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 59F191310AE for <>; Mon, 18 Feb 2019 15:33:25 -0800 (PST)
Received: by with SMTP id g1so31113087otj.11 for <>; Mon, 18 Feb 2019 15:33:25 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Aq663EfkQ8YuDKNsu0PR/2aUxab/l/H0VO4I5VB2Lt8=; b=N9qDYCE3I1zoxakC/DzMFxbH72kWiE3+CzKLZw3sAuFPNJb2ldurtnSjvZxH0xhp1y 75YR1YIburKqQEXQdzaXEGAF8sJhwmTZG2eROWLbwnfWwv6QC9X9wAvwSNf7nqRiEEeL n6NSeg4pB3ylMiJt1H0KJEXapuxvUjRx154dqryKLGbKKC+51EjlP8PPN81s07E1JmlP 0Y5kzvnJgYeBUlac+/+cnHDjNS8MTw5WmEvZ4ccaMxqXFj9hEuLwkQkfQYONSMz5DYDq BG2x+t6WsLDiCyJJrlYqkPuaQlP1EX4w26Pcs+aBnxwbYKQx4JR9lJ7bVVKrhPcKveak 43uA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Aq663EfkQ8YuDKNsu0PR/2aUxab/l/H0VO4I5VB2Lt8=; b=fHhHpCr/eU4eIbQ3jisfAhR4BVUovQNLaIdRcS2FYT0i5angQhoU4/Qq2D1VF2wAQH ZxuJ0I0aSxt0Tuv5PrGPa/KG3pqZun6zt3Sd0CQLZpWA1sOqTOybcWEzb07jbW9fY17L re52cEE8MSGQNp0u4SQB3kDe0PnPRKfcm/8yvlK5DnN/72+abJ+oom9W3e8+f1ts3SVf d4SK7wW+5mO7kPkSBwdClKEx/mQDZrZnhisO0acSdC5sS6bWgbJTS0THUjgu/aJNs07f JWunRXqGkIBBv2Kat/xPBUhHChewie0zpgEGajj+jhoJj1ZBkvIDJzjPjmd3rziHIAFT ShMQ==
X-Gm-Message-State: AHQUAubxhRKdkD1ubZURzXm9a3dguUJprQbUa64+YZiKAF4KxlwF0uf9 RZf5yJtkKWpqC36Lc2zkYxEz1YeDWrU/ZtYSrhs=
X-Google-Smtp-Source: AHgI3IYwakWCorlLxmZILQ3y3sDOXMgXnFk0Kq1Xe5F+5yNdBe03WGEEuAX+xpn1sLmglOUifpDOQdu0oj05a+dX4Kk=
X-Received: by 2002:a9d:6b94:: with SMTP id b20mr15620926otq.42.1550532804577; Mon, 18 Feb 2019 15:33:24 -0800 (PST)
MIME-Version: 1.0
References: <>
In-Reply-To: <>
From: Tony Arcieri <>
Date: Mon, 18 Feb 2019 15:33:13 -0800
Message-ID: <>
To: Fihlman Emil <>
Cc: "" <>
Content-Type: multipart/alternative; boundary="000000000000078df40582338d15"
Archived-At: <>
Subject: Re: [Cfrg] SHA256 based AEAD construction
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 18 Feb 2019 23:33:28 -0000

You might have a look at this paper, which specifies an AEAD scheme based
on hash functions (instantiated with SHA-256, but also usable with e.g.
SHA-3) as part of their pursuit of additional security properties (ccAEAD,
which adds a commitment scheme).

On Mon, Feb 18, 2019 at 3:17 PM Fihlman Emil <> wrote:

> Hi
> Let me first apologise if this is not the correct forum (if so, any
> pointers towards a place of discussion are appreciated).
> I recently implemented a SHA256 based AEAD crypto (base file
> and a test program / simple utility
> In a nutshell:
> We make an intermediate key kv by taking sha256(key|vector), which is then
> used to
> a) generate a random keystream by taking sha256(kv|counter), with which
> input is xorred by and
> b) take a hmac of the ciphertext for authentication.
> This concept is nothing new nor special. Some positives provided by this
> scheme are a) the base key is in the system only for a brief moment, b)
> it's very, very simple and easy to audit and use.
> My current idea is to release this as a foss library after refinements,
> mainly targeted for resource limited systems.
> I greatly appreciate any criticism, guidance, ideas and suggestions
> (especially improvements on reducing ram and cpu requirements and hardening
> against any timing/side channel attacks are welcomed, I suspect there are
> quite a few low hanging fruits at the moment).
> Emil Fihlman
> _______________________________________________
> Cfrg mailing list

Tony Arcieri