Re: [Cfrg] Extending SIV to other ciphers and MAC algorithms

[Neil Madden <[e-mail]>]

Hi Tony,

On 4 Oct 2018, at 14:25, Tony Arcieri <[e-mail]> wrote:
> 
> I am also interested in alternative SIV modes...
> 
> On Thu, Oct 4, 2018 at 3:12 AM Neil Madden <[e-mail]> wrote:
> As currently specified in RFC 5297, the mode is only defined for a MAC (AES-CMAC) that produces a 128-bit tag length.
> 
> ...specifically I have considered writing an I-D for PMAC, and specifying an RFC 5297-alike construction which swaps in PMAC in lieu of CMAC. I have already implemented this construction in the https://miscreant.io library.

Yes, I remember looking at miscreant. It’s a nice design.

> 
> That said...
>  
> As a concrete example, I am interested in SIV constructions based on XSalsa20 (or XChaCha20 as recently proposed on this list) together with some keyed hash MAC, such as HMAC-SHA256 or Blake2.
> 
> I think for IETF protocols you'll almost certainly want to use XChaCha20 over XSalsa20, as the latter has not been specified for IETF work, and is redundant with XChaCha20.

Thanks. I started writing some notes on this some time ago, at which point XSalsa20 was published while XChaCha20 was the “obvious” translation of the technique to ChaCha20, but didn’t seem to have a published reference document I could cite. Hopefully that will change if CFRG publish the XChaCha draft that was proposed.

> 
> If you're curious, here is some discussion about instantiating a SIV mode using ChaCha20 and Poly1305 as primitives. This is of course a bit tricky, as in the typical ChaCha20Poly1305 construction the Poly1305 key is derived from the beginning of the ChaCha20 keystream (hence why I assume you're proposing swapping in a PRF like HMAC as the basis of S2V):
> 
> https://github.com/briansmith/ring/issues/413

Yes, pretty much. The other reason was that if I found myself having to implement the mode from scratch, I would be more comfortable implementing SHA-256 or Blake2 than Poly1305, but that is more about my own experience and competence than about the security of the design. If you pair XChaCha20 with Blake2s then you can save some time by just copying + pasting the ChaCha round function, changing the direction of the rotations and you’re 90% done! :-)

— Neil