[Cfrg] Updated bounds in AES-GCM-SIV paper

[Adam Langley <[e-mail]>]

Dear CFRG,

We would like to thank Yannick Seurin and Tetsu Iwata for alerting us
to the fact that we had erroneously assumed that one of the terms in
the security bounds of AES-GCM-SIV was negligible when, for
indistinguishability, it was not. Thus, while the security proof was
correct, the example concrete bounds were over optimistic, most
notably for very large messages. This was most evident in Fig 4.

We have updated the paper[1] to correct this mistake and we draw the
group's attention to the revised figure four (now called Table 1). For
typical uses, thankfully, the difference is not material but for we
wish to highlight that one cannot encrypt many messages of
many-gigabytes using AES-GCM-SIV, in contrast to what the figures
previously suggested. However, even in such a case of very long
messages, the overall number of blocks encrypted safely is still
significantly higher than previous schemes.

[1] https://eprint.iacr.org/2017/168


Cheers

AGL

-- 
Adam Langley [e-mail] https://www.imperialviolet.org