Re: [Cfrg] AES-SIV versus AES-GCM for Encrypted Key Data

[Stephen Farrell <[e-mail]>]

On 17/05/16 14:50, Russ Housley wrote:
> I do not speak for NSA.  However, NSA only uses algorithms and modes
> that are FIPS-approved.  AES-SIV does not meet that requirement.  If
> that happens in the future, then the direction might change.

I don't speak for anyone:-)

I strongly believe that holding off from making improvements
of the basis of FIPS approval/certification is a really bad
idea. If a case can be made that the suggested change is less
good or no better than the FIPS approved/certified thing,
then that is a debate worth having, but waving the FIPS flag
is not itself IMO a good counter argument to a claim that
some change is an improvement.

And I'd be disappointed if an international organisation of
any kind did accept that kind of flag waving.

The fact that parts of the government in question were caught
cheating on exactly this kind process just a few years ago `
remains relevant to this discussion IMO. The fact that other
parts of the same government are good actors, IMO likely
including all those visibly involved, does not cancel that out.
In this case, that is another reason to not accept an argument
based solely on whether or not something has the blessing of
parts of that same govt. (And please do note that this paragraph
can equally be applied to any govt, not just the one concerned
here.)

S.