Re: [Cfrg] Critique of AES-GCM-SIV

[Marko Kreen <[e-mail]>]

On Fri, Feb 17, 2017 at 04:23:16PM +0200, Aaron Zauner wrote:
> 
> > On 17 Feb 2017, at 14:52, Marko Kreen <[e-mail]> wrote:
> > 
> > On Fri, Feb 17, 2017 at 11:00:56AM +0100, Daniel Bleichenbacher wrote:
> >> On Fri, Feb 17, 2017 at 1:02 AM, Marko Kreen <[e-mail]> wrote:
> >>> I have reviewed the AES-GCM-SIV proposal (draft 3).  And while there
> >>> are parts I like - overall direction to higher security and
> >>> getting rid of GCM bitflipping - current design feels "ugly".
> >>> (That's a cryptographic term.)
> > 
> >> I actually don't know what "ugly" means as a cryptographic term.
> > 
> > Well, it was supposed to be a joke...
> > 
> >> My guess would something like difficult to formally analyze.
> > 
> > But I think we are mostly on same page.  My main complaint was that
> > if it's nonce-misuse-resistant mode, then why does nonce misuse
> > have such a big effect on behaviour: on one case message is protected
> > by fresh key and counter, on other case only fresh counter.
> 
> Quick comment: This came up in an earlier thread on that topic
> already, I've also brought it up last spring. I think for this I-D in
> it's current form "nonce misuse resistant" might not be the best term
> (too strong, many people assume you can do what you want with the
> nonce with such a construction -- which certainly isn't the case for
> AES-GCM-SIV as proposed here). "nonce-misuse tolerant" came up and
> other suggestions. I haven't seen an update yet.

I'm not complaining about security level as their goal is to replace
AES-GCM, so anything better is a win.

Although better categorization may be good idea, I still feel current
approach can be categorized as "clumsy":

- AEAD with synthesized key and IV when master key or nonce are unique.
- AEAD with only synthesized IV when master key and nonce repeat.

Clearer would be just one mode which does not change category if nonce
repeats:

- AEAD with just synthesized IV (like AES-SIV), no rekey.
- AEAD with synthesized key and IV.

If there is already decision that rekey is OK, then I think it's better
to take time and synthesize both key and IV properly, thus
achieve full nonce misuse resistance.

-- 
marko