Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document

On Mar 30, 2016 9:56 PM, "denis bider" <ietf-cfrg@denisbider.com> wrote:
>
> I believe Dan's point was that AES256-GCM-SIV uses a 128-bit tag to
derive the final encryption key.
>
> Regardless of the original input key size, the encryption key is derived
in a way that, at some point, is reduced to 128 bits of entropy.
>
> I find this to be a good point, and indeed, a plausible concern.
>

If true, it may even be a fairly large concern.  If each message uses a
separate 128-bit key, then this could plausibly be subject to the type of
parallel attack djb loves talking about where each *message* is a target.
That would make collecting 2^64 or so potentially interesting ciphertexts
considerably easier than with most modes.

But it looks like the key is just a normal key.

--Andy

>
>
> ----- Original Message -----
> From: Tony Arcieri
> Sent: Wednesday, March 30, 2016 19:11
> To: Dan Harkins
> Cc: Yehuda Lindell ; cfrg@irtf.org ; Adam Langley
> Subject: Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant
Authenticated Encryption" as a CFRG document
>
> On Wed, Mar 30, 2016 at 12:22 PM, Dan Harkins <dharkins@lounge.org> wrote:
> Would you agree that AEAD_AES_256_GCM_SIV provides no more
> security than AEAD_AES_128_GCM_SIV? I say this because the
> authentication key is 128-bits regardless
>
> I disagree with this. 128-bits of symmetric security is fine today. The
threats where you might want 256-bit encryption are things like
hypothetical future quantum computers which are able to use Grover's
algorithm.
>
> Encryption needs to stand the test of time. Authentication has less
burdensome demands. If it's possible to pull off an online chosen
ciphertext attack after the advent of quantum computers which can use
Grover's algorithm to break 128-bit crypto (10+ years in the future
maybe?), the story might be different, but for long-term confidentiality of
ciphertexts I think a larger key size for a symmetric cipher is more
important.
>
> The same argument can be applied to digital signatures and quantum
cryptography: they matter less than encryption, because we can resign data
if a quantum attack seems imminent, but if a quantum attacker already has
access to ciphertexts there's nothing we can do.
>
> --
>
> Tony Arcieri
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>