Re: [Cfrg] AES-SIV versus AES-GCM for Encrypted Key Data

On Mon, May 16, 2016 1:56 pm, Russ Housley wrote:
>
> On May 16, 2016, at 3:35 PM, Paul Lambert <paul@marvell.com> wrote:
>
>> I would think that nonce/counter misuse protection would be an advantage
>> for this type of application.
>
> I do not see how.  There is a fresh key-encryption key for each wrap.
> Where can the counter be reused.

  The application isn't really key wrapping, it's protection of some
handshaking messages for an authentication protocol. The resulting
security association is a bit longer-lived so subsequent packets for
on-going maintenance of the SA-- like rekeying traffic keys-- would use
the same (now "unfresh") key.

  Parts of the packet get encrypted and the whole thing gets
authentication. So instead of doing an ad hoc construction of cipher
(in CBC mode, or CTR mode, or ...) and MAC (HMAC-SHAXYZ) and making
sure the order is right it's easier to use a provably secure construction
that does authenticated encryption with AAD. Using one that doesn't
require any kind of additional nonce to be contributed is more attractive.
Robust misuse resistance is a virtue for a thing like this.

  regards,

  Dan.

> Russ
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>