Re: [Cfrg] new authenticated encryption draft

["John Wilkinson" <[e-mail]>]

On 8/20/06, Greg Rose <[e-mail]> wrote:
> At 11:47  -0700 2006/08/20, Hal Finney wrote:
> >
> >It is outside the scope of your document, but I have found from my
> >disk experience that the approach in these algorithms of letting the
> >AEAD algorithm manage uniqueness of IVs at the "micro scale" while the
> >caller manages uniqueness at the "macro scale" can actually lead to
> >very inefficient allocation of IV space. For example, with GCM taking
> >an external IV contribution of 64 bits, if the caller is encrypting a
> >lot of short messages in a context where it must be stateless and pass
> >in a random IV contribution, it can only encrypt 2^32 such messages
> >under a given key. The seemingly vast IV space is eroded to a very
> >significant limitation similar to what we had in the old days of DES.
>
> This "erosion" only happens if the requirement is that the IV be
> random and unpredictable to an attacker. Most AEAD systems don't
> require this strong guarantee, and any form of Nonce will usually do;
> the only requirement being uniqueness. So the 64 bit input, provided
> in the form of a counter, is good to the same order-of-magnitude
> limit as the block cipher itself.

Gregg, unless I'm missing something, in the _stateless_ case Hal
mentions, the IV/nonce must be random (since a counter requires
state), and the potential for nonce "collisions" becomes unacceptably
high after many fewer than 2^32 encryptions.

David, while I've only briefly skimmed your draft, Hal and Gregg's
comments make me wonder about the way you're treating IVs in your
specification. Why do you feel that IVs must be an _output_ of the
encryption algorithm, rather than a purely internal value? Further,
what, exactly, do you mean by the requirement that "A deterministic
AEAD encryption algorithm MUST accept an additional input, and that
value [the IV contribution] MUST be included _verbatim_ [emphasis
added] in the IV."

It seems to me that it would be a better abstraction of the AEAD
mechanism if the IV is used purely internally to the algorithm, so
that the only input required is a nonce, and that the same nonce is
used for encryption and decryption. Furthermore, the requirement that
the "IV contribution" must be used "verbatim" in the IV could be read
to exclude, for example, Bellare, Rogaway, and Wagner's EAX mode. EAX
uses a user-supplied nonce, which may be of any length, and computes a
MAC on this nonce to generate the initial counter for counter-mode
encryption.

-John

_______________________________________________
Cfrg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/cfrg