[CFRG] Re: RGLC on draft-irtf-cfrg-aead-limits

[Felix Günther <[e-mail]>]

Dear John,

The goal of the aead-limits document is to provide

   "simple guidance for users of common AEAD functions about how to limit the use of keys in order to bound the advantage given to an attacker"

helping to calculate the adversary's advantage in different deployments. Again, quoting the document:

   "The intent of this document is to collate all relevant information about the proper usage and limits of AEAD algorithms in one place."


Thank you for confirming that the formulas indeed capture the bounds of the underlying scientific papers.
As we've already agreed earlier, if rekeying is done, limits have to be based on multi-user limits; thanks for acknowledging that this previous issue you raised has been addressed.


We understand that you'd prefer guidance for rekeying to e.g. refer to using ephemeral asymmetric key exchange.
Such guidance however is out-of-scope for this document, whose intent is to provide advantage bounds for AEAD key usage.
While we accept that we might disagree on the scope and your overall view on the document then, we'll still add a mention of your point in the introduction (PR#83 https://github.com/cfrg/draft-irtf-cfrg-aead-limits/pull/83)


Cheers,
Felix


On 2026-07-22 08:52 +0200, John Mattsson <[e-mail]> wrote:
> Eric Rescorla:
>  >I have not double checked the formulae
> 
> The formulas are fine, they are taken from published papers and can be used to calculate the adversary's advantage. The bigger question is why CFRG would recommend the naive approach of imposing a limit and then retiring the key. The draft provides no justification for why this is a good approach, even though it can clearly reduce availability and result in increased multi-key security advantages. I do not think the procedures recommended in this draft constitute good guidance for IETF working groups using AEADs.
> 
> I looked at the Multi-Key section for the first time:
> 
>  >AEA <= (v * (L' + 1)) / 2^103
>  >
>  > This implies the following limit:
> 
> This is not correct. The bound very clearly implies that you do not need to rekey (and not rekeying leads to a loss of availability and should not be an option).
> 
> The previous version recommended using single-key advantages for rekeying in ways that could increase the overall multi-key advantage. That specific issue appears to have been addressed, but the problem of reduced availability remains.
> 
> Question: Is it proven that rekeying based on a multi-key advantage limit cannot increase the overall advantage?
> 
> I do not think CFRG should publish this document in its current form.
> - If the goal is to provide an overview of existing bounds on adversarial advantage, I think the guidance on how to apply these bounds should be removed, and the document could be published in that form.
> - If the goal is to provide guidance to IETF working groups using AEADs, then the document requires substantial additional work. In its current form, it risks reducing security rather than improving it.
> 
> If IETF working groups need guidance on rekeying, it is straightforward to provide such advice. For example: Best practice is to rekey using an ephemeral asymmetric key exchange that provides Forward Secrecy (FS) and Post-Compromise Security (PCS) after 1 hour or 1–100 GB of data.
> 
> Cheers,
> John Preuß Mattsson
> 
> *From: *Eric Rescorla <[e-mail]>
> *Date: *Saturday, 11 July 2026 at 00:38
> *To: *Stanislav V. Smyshlyaev <[e-mail]>
> *Cc: *CFRG <[e-mail]>; [e-mail] <[e-mail]>; [e-mail] <[e-mail]>
> *Subject: *[CFRG] Re: RGLC on draft-irtf-cfrg-aead-limits
> 
> This document is clear and useful and I believe CFRG should publish it.
> 
> I have not double checked the formulae, but as I understand it, the authors have done so and solicited sufficient external review.
> 
> -Ekr
> 
> 
> On Sat, Feb 28, 2026 at 8:12 AM Stanislav V. Smyshlyaev <[e-mail] <mailto:[e-mail]>> wrote:
> 
>     Dear CFRG,
> 
>     We haven't received any comments during this RGLC extension.
> 
>     Please comment if you have read the document, especially the most recent version draft-irtf-cfrg-aead-limits-11.
> 
>     Best regards,
>     Stanislav (for chairs)
> 
>     On Tue, Feb 3, 2026 at 10:33 AM Stanislav V. Smyshlyaev <[e-mail] <mailto:[e-mail]>> wrote:
> 
>         Dear CFRG,
> 
>         The authors of draft-irtf-cfrg-aead-limits have addressed the concerns raised during the RGLC (see https://author-tools.ietf.org/iddiff?url1=draft-irtf-cfrg-aead-limits-09&url2=draft-irtf-cfrg-aead-limits-11&difftype=--html <https://author-tools.ietf.org/iddiff?url1=draft-irtf-cfrg-aead-limits-09&url2=draft-irtf-cfrg-aead-limits-11&difftype=--html>).
> 
>         We didn't finish the RGLC last time, so we are now formally extending the RGLC: it will end on February 28th.
> 
>         We got a review of the draft from Thomas Pornin (on behalf of the Crypto Review Panel): https://mailarchive.ietf.org/arch/msg/crypto-panel/AKkf4W6n_JgDlvHlOdQphb932jQ/ <https://mailarchive.ietf.org/arch/msg/crypto-panel/AKkf4W6n_JgDlvHlOdQphb932jQ/>
>         The comments were addressed in version -09 of the draft.
> 
>         If you've read the document and think that it is ready (or not ready) for publication as an RFC, please send a message in reply to this email or directly to CFRG chairs ([e-mail] <mailto:[e-mail]>). If you have detailed comments, these would also be very helpful at this point.
> 
>         Best regards,
>         Stanislav (for CFRG chairs)
> 
>         On Mon, Jan 13, 2025 at 2:52 PM Stanislav V. Smyshlyaev <[e-mail] <mailto:[e-mail]>> wrote:
> 
>             Dear CFRG participants,
> 
>             This message is starting a 3-week RGLC on draft-irtf-cfrg-aead-limits-09 ("Usage Limits on AEAD Algorithms") that will end on February 3rd 2025. If you've read the document and think that it is ready (or not ready) for publication as an RFC, please send a message in reply to this email or directly to CFRG chairs ([e-mail] <mailto:[e-mail]>). If you have detailed comments, these would also be very helpful at this point.
> 
>             We've got a review of the draft from Thomas Pornin (on behalf of the Crypto Review Panel): https://mailarchive.ietf.org/arch/msg/crypto-panel/AKkf4W6n_JgDlvHlOdQphb932jQ/ <https://mailarchive.ietf.org/arch/msg/crypto-panel/AKkf4W6n_JgDlvHlOdQphb932jQ/>
>             The comments were addressed in version -09 of the draft.
> 
>             Thank you,
>             Stanislav, for CFRG chairs
> 
>     _______________________________________________
>     CFRG mailing list -- [e-mail] <mailto:[e-mail]>
>     To unsubscribe send an email to [e-mail] <mailto:[e-mail]>
>