Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

>>-03 is hopefully clearer on this point:
>> https://tools.ietf.org/html/draft-gueron-gcmsiv-03#section-4
>
>This is much clearer to me.
>
>However:
>
>   This record-encryption
>   key is defined as the concatenation of the result of encrypting,
>   using the AES key, the nonce with the least-significant bit of the
>   first byte set to zero and then to one.
>
>Why is it designed this way?  This has the odd property that the
>record encryption key is the same for two messages with nonces that
>differ only in the LSB of the first byte.

You’re right!

>Alternative designs include:
>
>a) Concatenate the results of encrypting the nonce and the none with
>the LSB of the first byte flipped.
>
>b) Concatenate the results of encrypting the nonce and the nonce + 1.

Have we all forgot the good ol’ OFB mode? This seems a perfect use case
for it. Take the 128-bit nonce as the seed and crank AES-256 engine twice
to get two 128-bit pseudorandom blocks. Concatenate them and use as the
record key. Same performance as what you’re getting, better security - and
the advantage of staying with standardized block cipher modes :).

>It still seems to be that performance for short block sizes may be
>rather poor given the key setup needed.

Can’t comment, but frankly don’t care much.