Re: [CFRG] Update of the AEGIS draft

I reviewed -02.

Looks good. Two small points.

§3.1. So the consequences of nonce reuse are worse than with AES-GCM. Might
be worth a mention.

§3.3. Might be helpful to recall the definition of C0 and C1.

Best,

 Bas

On Fri, Apr 14, 2023 at 3:57 PM Frank Denis <cfrg=
40pureftpd.org@dmarc.ietf.org> wrote:

> Hi all,
>
>
> A new revision of the draft on the AEGIS family of authenticated
> encryption algorithms was recently published.
>
>
> AEGIS is an AEAD designed for high performance applications, with
> significant advantages over AES-GCM:
>
> - Fast. 2x to 4x faster than AES-GCM on CPUs with AES pipelines. Software
> implementations also tend to be faster
>
> - Very simple to implement securely and efficiently using only the AES
> forward round function
>
> - Reduced memory usage: doesn’t require precomputing a key schedule nor
> powers of the MAC key to achieve optimal performance
>
> - Large nonce size (128 bits for AEGIS-128L, 256 bits for AEGIS-256)
>
> - Better security bounds
>
> - Context committing
>
> - Backtracking resistant
>
>
> In addition to internal deployments, AEGIS is already deployed in OVH
> routers, in the Linux kernel and in VPN software.
>
>
> Multiple implementations exist (C, C++, Rust, Zig, Python, Go, Assembly),
> most of them having been written independently, using only the
> specification:
>
> https://github.com/jedisct1/draft-aegis-aead#known-implementations
>
> In addition to reference code and to the specification, Google’s Project
> Wycheproof includes an extensive set of test vectors for AEGIS.
>
>
> For evaluation purposes, AEGIS can be used as an alternative to AES-GCM in
> the context of TLS.
>
> In order to ensure interoperability, IANA has assigned identifiers for
> AEGIS-based cipher suites.
>
> There is a maintained fork of BoringSSL that supports these cipher suites.
> The TLS stack of the Zig standard library also supports these suites out of
> the box.
>
>
> Feedback would be very useful. We would love to see this document move
> forward.
>
>
> Direct links to the draft:
>
> - latest version (editor’s copy):
> https://jedisct1.github.io/draft-aegis-aead/#go.draft-irtf-cfrg-aegis-aead.html
>
> - datatracker page:
> https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead
>
>
> Kind regards,
>
>
> -Frank.
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>