Re: [Cfrg] SIV for non-AES ciphers first draft

[Neil Madden <[e-mail]>]

I think I will update the draft to use keyed Blake2s rather than HMAC-SHA-256, as it has several advantages in terms of speed and features. I will try and update the I-D this week.

Does anybody have any other feedback? Is the subject matter of interest to CFRG?

The draft link again: https://tools.ietf.org/html/draft-madden-generalised-siv-00

Kind regards,

Neil

> On 26 Nov 2018, at 09:41, Neil Madden <[e-mail]> wrote:
> 
> I’m not wedded to HMAC-SHA256, so Blake2 is an attractive option. I went with HMAC-SHA256 because it seems good enough and fairly ubiquitous.
> 
> If we went for Blake2 then there are a number of decisions to be made:
> 
> 1. Do we pick Blake2b or Blake2s? My mild preference would be for the s variant as both cipher and MAC then work well on 32-bit systems and it requires less RAM.
> 
> 2. Do we go for 256-bit auth tag (as now), or take advantage of Blake2’s variable length output to produce a 192-bit tag, exactly matching the nonce required for XChaCha? A 256-bit auth tag is probably excessive for most uses.
> 
> 3. Do we use Blake2’s native keyed hash support or use HMAC-Blake2? See [1] for some arguments in favour of using HMAC, but then keyed Blake2 is (presumably) faster.
> 
> [1] http://noiseprotocol.org/noise.html#hash-functions-and-hashing
> 
> — Neil
> 
>> On 26 Nov 2018, at 08:07, Paul Lambert <[e-mail]> wrote:
>> 
>> On the draft …
>> Given the benefits of Blake2 and it’s similar construction to ChaCha, why not use Blake2 instead of HMAC-SHA-256?
>> 
>> Paul
>> 
>> 
>>> On Nov 22, 2018, at 9:22 AM, Neil Madden <[e-mail]> wrote:
>>> 
>>> I have now uploaded a (very rough) first draft describing how to extend the SIV mode of operation to non-AES ciphers and MACs, as previously discussed on this list.
>>> 
>>> The I-D is available here: https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dmadden-2Dgeneralised-2Dsiv_&d=DwIGaQ&c=qgVugHHq3rzouXkEXdxBNQ&r=oIg4FfS8P761BlhMPJ2ys3IvSyH4XQ12Mbj_mXrCAJs&m=5WQpmA8deCCE8ehAcBhR-0SwNWDHfNA7dEo1IVxbNUM&s=Bs8DJzvOJ6KwhzN8Yti0sRCdOT5r02Ho7m3qmNKJpuI&e=
>>> The source is on Github here: https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_NeilMadden_draft-2Dmadden-2Dgeneralised-2Dsiv&d=DwIGaQ&c=qgVugHHq3rzouXkEXdxBNQ&r=oIg4FfS8P761BlhMPJ2ys3IvSyH4XQ12Mbj_mXrCAJs&m=5WQpmA8deCCE8ehAcBhR-0SwNWDHfNA7dEo1IVxbNUM&s=qgsdZqOvSNNunN3u9v69TfSUfrP3mW7OV865Ui6qq8E&e=
>>> 
>>> Feedback welcome. Hopefully I’ve managed to wrestle xml2rfc to produce the right output.
>>> 
>>> Kind regards,
>>> 
>>> Neil Madden
>>> _______________________________________________
>>> Cfrg mailing list
>>> [e-mail]
>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.irtf.org_mailman_listinfo_cfrg&d=DwIGaQ&c=qgVugHHq3rzouXkEXdxBNQ&r=oIg4FfS8P761BlhMPJ2ys3IvSyH4XQ12Mbj_mXrCAJs&m=5WQpmA8deCCE8ehAcBhR-0SwNWDHfNA7dEo1IVxbNUM&s=g8oGz_kyMuTTp26sl6yblddFB_S1C5LiXRE9KKXhvxw&e=
>> 
>