Re: [CFRG] Call for adoption for draft-denis-aegis-aead

[Taylor R Campbell <[e-mail]>]

> Date: Thu, 28 Jul 2022 19:15:23 +0000
> From: "Blumenthal, Uri - 0553 - MITLL" <[e-mail]>
> 
> > > From the draft:
> > >
> > > With AEGIS-256, random nonces can be used with no practical limits.
> >
> > We have use cases where we would like to encrypt >>>2^32 messages
> > with random nonces. GCM limits us to 2^32 messages with random IVs,
> > and it's not always possible to use deterministic IVs. Even when
> > it _is_ possible to use deterministic IVs, we sometimes would like
> > to encrypt >>2^64 messages with the same key. So having an AEAD scheme
> > which supports a practically-unbounded number of messages per key would be useful.
> 
> As I said before, my main problem with AEGIS is that nonce
> misuse/reuse breaks it.
> 
> With that in mind, I think that AEGIS is better than AES-GCM, but
> worse than an "ideal" AEAD that I'd like to see standardized and
> widely deployed.

Won't claim it's ideal, but ChaCha-Daence:

(a) supports a practically-unbounded number of messages per key[1];
(b) falls back to deterministic authenticated encryption security like
    AES-SIV if you don't have unique per-message numbers or if your
    RNG/counter goes wrong;
(c) can take advantage of public or secret message numbers, whether
    deterministic or random;
(d) does not require a randomized nonce like AES-GCM-SIV does for
    nonce-misuse-resistance;
(e) has a simpler interface, DAE (key,ad,message), than nonce-based
    AEAD (key,nonce,ad,message); and
(f) is built out of the same components as ChaCha/Poly1305 so it only
    takes a few lines of code with those components to implement it,
    so it's cheap to drop into applications that already use libraries
    with ChaCha and Poly1305 today -- no assembly (code) required.

Details and security theorem: https://eprint.iacr.org/2020/067

[1] Table of advantage bounds on p. 5 of the manuscript is generated
    by https://github.com/riastradh/daence/blob/master/adv.py, with
    references there to the best advantage bounds in the literature on
    AES-GCM, AES-GCM-SIV, AES-SIV, and ChaCha/Poly1305 security.