Re: [Cfrg] AES-SIV versus AES-GCM for Encrypted Key Data

On May 16, 2016, at 8:30 PM, Dan Harkins <dharkins@lounge.org> wrote:

> 
> 
> On Mon, May 16, 2016 1:56 pm, Russ Housley wrote:
>> 
>> On May 16, 2016, at 3:35 PM, Paul Lambert <paul@marvell.com> wrote:
>> 
>>> I would think that nonce/counter misuse protection would be an advantage
>>> for this type of application.
>> 
>> I do not see how.  There is a fresh key-encryption key for each wrap.
>> Where can the counter be reused.
> 
>  The application isn't really key wrapping, it's protection of some
> handshaking messages for an authentication protocol. The resulting
> security association is a bit longer-lived so subsequent packets for
> on-going maintenance of the SA-- like rekeying traffic keys-- would use
> the same (now "unfresh") key.
> 
>  Parts of the packet get encrypted and the whole thing gets
> authentication. So instead of doing an ad hoc construction of cipher
> (in CBC mode, or CTR mode, or ...) and MAC (HMAC-SHAXYZ) and making
> sure the order is right it's easier to use a provably secure construction
> that does authenticated encryption with AAD. Using one that doesn't
> require any kind of additional nonce to be contributed is more attractive.
> Robust misuse resistance is a virtue for a thing like this.
> 
>  regards,
> 
>  Dan.
> 
>> Russ
>> 
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> https://www.irtf.org/mailman/listinfo/cfrg
>> 
> 
> 
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg