Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document

["Dan Harkins" <[e-mail]>]

On Wed, March 30, 2016 8:40 pm, Tony Arcieri wrote:
> On Wed, Mar 30, 2016 at 6:56 PM, denis bider <[e-mail]>
> wrote:
>
>> I believe Dan's point was that AES256-GCM-SIV uses a 128-bit tag to
>> derive
>> the final encryption key.
>>
>
> No?
>
> 4.  Encryption
>
>    AES-GCM-SIV encryption takes a 16-byte authentication key, a 16- or
>    32-byte AES key, a 128-bit nonce, and arbitrary-length plaintext and
>    additional data inputs.  It outputs an authenticated ciphertext that
>    will be 16 bytes longer than the plaintext.

  Not sure what you mean by "No?".

  My point was that regardless of whether it's the 128- or 256-bit
option the _authentication key_ used is only 128-bits; and, when
using the 256-bit option the "record encryption key" can only take
on 2^128 values.

  So, if the effective authentication and encryption keys being used
in the cipher mode are always 128-bits then the 256-bit option does
not provide any more security than the 128-bit option. And if that's
the case then there is no reason to have AEAD_AES_256_GCM_SIV. Right?

  regards,

  Dan.



> --
> Tony Arcieri
>