Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document

Introducing a new AEAD scheme outside of the CAESAR process devalues CAESAR, ultimately reducing CAESAR's importance. It would have been much better for AES-GCM-SIV to be introduced as part of the CAESAR process and have it win mindshare based on its merits rather than its "first mover" status. By advancing this RFC, we likely entrench AES-GCM-SIV to every other CAESAR candidate's detriment.

Might it be better to integrate this new proposal with CAESAR somehow? Perhaps the CAESAR committee could invite AES-GCM-SIV to become an official candidate, and then all the CAESAR candidates could be considered by CAESAR and CFRG on level terms? Or barring CAESAR allowing AES-GCM-SIV into the competition late, CFRG could delay consideration of the AES-GCM-SIV RFC until CAESAR recommends its portfolio. We don't want to bless too many AEAD schemes. If AES-GCM-SIV is not best-in-class, we don't want to recommend it at all, but we won't know that until CAESAR has finished its work.

The end result of delaying the AES-GCM-SIV RFC would likely be a smaller number of better AEAD schemes being recommended: either an improved AES-GCM-SIV RFC evolves because it goes through a more rigorous vetting process and gets improved along the way, or it doesn't get recommended and something better does.

Ted Krovetz
(author of HS1-SIV CAESAR submission)

> On Mar 28, 2016, at 7:34 AM, Paterson, Kenny <Kenny.Paterson@rhul.ac.uk> wrote:
> 
> Dear CFRG,
> 
> Shay, Adam and Yehuda have asked the CFRG chairs whether their draft for
> AES-GCM-SIV can be adopted as a CFRG document. We are minded to do so, but
> first wanted to canvass members of the group for their opinions on taking
> this step.
> 
> We are aware of the on-going CAESAR competition for AEAD schemes.
> AES-GCM-SIV is not a CAESAR candidate. CFRG adopting this document should
> not be interpreted as competing with or pre-empting the results of that
> very valuable activity. Indeed, once CAESAR is complete, we hope that some
> or all of the competition winners will end up being turned into RFCs under
> the auspices of CFRG.
> 
> Regards,
> 
> Kenny (for the chairs)
> 
> 
> On 06/03/2016 03:50, "Cfrg on behalf of Shay Gueron"
> <cfrg-bounces@irtf.org on behalf of shay.gueron@gmail.com> wrote:
> 
>> Hello CFRG,
>> 
>> 
>> We would like to draw your attention to our new submission draft entitled
>> “AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption”. Posted on
>> https://www.ietf.org/internet-drafts/draft-gueron-gcmsiv-00.txt
>> 
>> The submission specifies two authenticated encryption algorithms that are
>> nonce misuse-resistant. Their performance is expected to be roughly on
>> par with AES-GCM,
>> when run on modern processors that have AES instructions.
>> 
>> Security and performance analysis can be found in S. Gueron and Y.
>> Lindell. GCM-SIV: Full Nonce Misuse-Resistant Authenticated Encryption at
>> Under One Cycle
>> per Byte. In 22nd ACM CCS, pages 109-119, 2015.
>> 
>> We hope that the CFRG will take this up as a working-group item.
>> 
>> Thank you,
>> 
>> 
>> Shay Gueron, Adam Langley, Yehuda Lindell
>> 
>> 
>> 
> 
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg