Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications

["Gueron, Shay" <[e-mail]>]

OK, I did not understand what Andy meant...

Indeed, for deriving the encryption in the 256-bit key case, the nonce 
has effectively 127 bits.

Repeating this (127-bit) nonce degenerates the encryption to using the 
same 256-bit key.

Still, the CTR mode encryption that follows, is not going to leak 
information unless the same message (with the same 127-bit IV) is 
encrypted. In such, the equality of the message is revelaed. But this is 
the nature of the deterministic processing, and this is what the nonce 
misuse resistance provides.

Of course, there is another consideration: if on top of all this, there 
is a collision in the 96 bits of the CTR mode IV, which is derived from 
the POLYAVAL universal hash (and the nonce). This is addressed in the 
security considerations section.
(as promised, exact bounds will follow in a paper that we will soon 
release)

Regards, Shay


------ Original Message ------
From: "Blumenthal, Uri - 0553 - MITLL" <[e-mail]>
To: "Shay Gueron" <[e-mail]>; "Andy Lutomirski" 
<[e-mail]>
Cc: "Adam Langley" <[e-mail]>; "Yehuda Lindell" 
<[e-mail]>; "[e-mail]" <[e-mail]>; "Adam 
Langley" <[e-mail]>
Sent: 4/21/2016 11:11:33 PM
Subject: Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant 
Authenticated Encryption" as a CFRG document ---- Some clarifications

>I’m afraid Andy is correct. Say one record has its nonce xxxx…xxxx0 
>(127 bits plus 0), and another record has its nonce xxx…xxx1. The 
>record key produced for both records will be the same, because it 
>clobbers/ignores the LSB.
>
>Again, why don’t you just use AES256-OFB to produce 256-bit record key?
>--
>Regards,
>Uri Blumenthal
>
>From: Cfrg <[e-mail]> on behalf of Shay Gueron 
><[e-mail]>
>Date: Thursday, April 21, 2016 at 16:06
>To: Andy Lutomirski <[e-mail]>
>Cc: Adam Langley <[e-mail]>, Yehuda Lindell 
><[e-mail]>, CFRG <[e-mail]>, Adam Langley 
><[e-mail]>
>Subject: Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant 
>Authenticated Encryption" as a CFRG document ---- Some clarifications
>
>>Andy,
>>
>>Addressing your concern:
>> >>> This has the odd property that the
>> >>> record encryption key is the same for two messages with nonces 
>>that
>> >>> differ only in the LSB of the first byte.
>>This is not the case. What the spec states means the following:
>>The record encryption key is derived by
>>
>>AES256 (NONCE[127:1] || 0) || AES256 (NONCE[127:1] || 1)
>>
>>I hope this helps clarifying.
>>Regards, Shay