[CFRG] Re: Comments on draft-irtf-cfrg-aead-properties-09.txt

[Andrey Bozhko <[e-mail]>]

Dear Akiko, Tetsu, and Kazuhiko,

Thank you very much for your comments and for sharing your paper—it's an
exciting and highly interesting work.

Unfortunately, adding (or subdividing) properties won’t be possible at this
stage, as the list of properties was finalized some time ago, prior to the
technical reviews. However, I believe adding clarifications on examples
based on your paper and, in particular, correcting the mention of OCB in
the Inverse-Free section (many thanks for catching that!) should be
possible during the editorial stage when it’s the draft’s turn in the queue.

Additionally, once the draft is published, I plan to maintain a somewhat
extended (and experimental) version on GitHub (
https://github.com/AndAlBo/draft-irtf-cfrg-aead-properties) since the
field is still actively evolving. I intend to incorporate your comments
there in more detail as well. Please feel free to propose any further
changes or improvements there.

Once again, thank you for your valuable comments!

Best,
Andrey

On Tue, Feb 4, 2025 at 09:08 MINEMATSU KAZUHIKO(峯松 一彦) <k-minematsu=
[e-mail]> wrote:

> Dear all,
>
> We recently learned about the I-D on AEAD
> (draft-irtf-cfrg-aead-properties-09) and found it quite relevant in
> practice.
> As we published a paper on robustness of common AEs ([IIM25], will appear
> at
> CT-RSA 2025), we would like to share our comments on the draft.
>
> In [IIM25], Table 1 provides a comprehensive view on nonce-misuse or RUP
> security of GCM/CCM/OCB(3), which would be helpful to improve Sections
> 4.3.7
> and 4.3.10 of the draft. Concretely:
> 1. Sect 4.3.7, Nonce-misuse resilience confidentiality (NML-Priv in our
> paper): it holds for GCM but only with 96-bit nonce. This was shown by
> [ADL17]. Our paper shows that CCM has NML-Priv.
> 2. Sect 4.3.7, Nonce-misuse resistance (NMR in our paper): NMR could be
> further classified into confidentiality (privacy) and authenticity as the
> draft did for NML. Then we have two notions, Nonce-misuse resistance
> confidentiality/privacy (NMR-Priv) and Nonce-misuse resistance
> authenticity/integrity (NMR-Auth). [IIM25] shows that CCM has NMR-Auth
> (even
> stronger. See below).
> 3.  Sect 4.3.10: INT-RUP could be classified into the cases where nonce may
> be repeated or not. We can also consider combined notions such as NMR +
> INT-RUP.
> [IIM25] shows that
> - GCM has plain INT-RUP (i.e. nonce does not repeat in encryption queries)
> - CCM has NMR-INT-RUP (i.e. nonce may repeat at any query).
>
> As a side note, at Sect 4.4.2 (Inverse-Free), OCB was listed as an example,
> which is not correct. If you mean an inverse-free OCB-like parallel AE
> mode,
> OTR [Min14] would be the right one here.
> Moreover, COFB [CIMN17], the base scheme of a NIST LwC finalist GIFT-COFB,
> is an inverse-free serial AE mode enabling smaller state than OCB/OTR.
>
> We hope these comments will help improving the draft.
>
> Best regards,
> Akiko Inoue
> Tetsu Iwata
> Kazuhiko Minematsu
>
>
> [IIM25] Comprehensive Robustness Analysis of GCM, CCM, and OCB3, Akiko
> Inoue, Tetsu Iwata and Kazuhiko Minematsu
> https://eprint.iacr.org/2024/1339 (to appear at CT-RSA 2025)
>
> [Min14] Parallelizable Rate-1 Authenticated Encryption from Pseudorandom
> Functions, Kazuhiko Minematsu. EC 2014
> https://eprint.iacr.org/2013/628
>
> [CIMN17] Blockcipher-based Authenticated Encryption: How Small Can We Go?,
> Avik Chakraborti, Tetsu Iwata, Kazuhiko Minematsu, and Mridul Nandi, CHES
> 2017.
> https://eprint.iacr.org/2017/649
> _______________________________________________
> CFRG mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>