[Cfrg] RFC 5297 and absent vs. zero-length nonces

[Daniel Franke <[e-mail]>]

The IANA considerations section of RFC 5297 (Synthetic Initialization
Vector (SIV) Authenticated Encryption Using the Advanced Encryption
Standard (AES)) gives N_MIN as 1. However, S2V is perfectly capable of
accepting zero-length arguments. Furthermore, passing a zero-length
argument to S2V is distinct from not passing that argument at all (as
done in the case deterministic encryption). How should an
implementation behave when provided with a zero-length nonce?

Should it return an error, since its length is under N_MIN?

Should it pass it along to S2V just like any other nonce input?

Or should it treat this as a request for deterministic encryption and
not pass any nonce to S2V?