Re: [Cfrg] Security analysis of draft-smyshlyaev-re-keying-00.txt

Dear Watson,
We've never stated any improvements of authenticity bounds.

(and, moreover, I don't think that the probability of L/2^{128} needs to be
decreased at all).

If you look at the preprint (http://eprint.iacr.org/2016/628.pdf) we cited,
you'll see that it's all about 1) increasing key lifetime regarding the
confidentiality bounds, 2) limiting the key exposure - both regarding
adversaries that apply classical methods (linear, differential etc.) and
side-channel attacks.

Regards,

Stanislav

2016-11-07 20:58 GMT+03:00 Watson Ladd <watsonbladd@gmail.com>:

> Dear all,
>
> draft-smyshlyaev-re-keying-00.txt fails to achieve its stated security
> goals, for fairly trivial reasons.
>
> Draft-smyshlyaev-re-keying-00 uses the same value of H for the entire
> message. The authenticity bounds for GCM depend on the length of the
> message, not the number of blocks encrypted with the same key.
> Therefore this bounds are not improved by the rekeying mechanism
> proposed. The probability of forgery is L/2^{-128} where L is the
> length of the message, and therefore we do not have beyond-birthday
> bound security with this proposed mechanism.
>
> Sincerely,
> Watson Ladd
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>