[CFRG] AEAD limits

[Yoav Nir <[e-mail]>]

Following up on my mostly failed attempt to raise the issue at the meeting.

I still think we need to have, at least in an appendix, a table with actual limits in either bytes or packets.

Sure, this requires setting at least p and l.  p can be chosen arbitrarily (2^(-65)? 2^(-57)?), although I’d like an explanation of why a certain number makes sense.  l can be the row of the table.

For example, for p = 2^(-65) and l=1024 we get for AES-GCM that q<=2^22, so the table can show for this value of l 4 million packets and/or 4 GB.  For ChaCha20-Poly1305 you’d get v<=2^28 so you’d get 256 million packets or 256 GB.  With p at 2^(-57) you get other numbers. Still useful regardless or which value of p is chosen.

And one nit:  Please change the description of p in Table 1 from “Adversary attack probability” to “Adversary attack success probability"