Re: [Cfrg] AES GCM SIV analysis

[Andy Lutomirski <[e-mail]>]

On Fri, Jan 27, 2017 at 12:21 PM, Adam Langley <[e-mail]> wrote:
> On Thu, Jan 26, 2017 at 6:26 PM, Dan Harkins <[e-mail]> wrote:
>>   But that is the definition used in the seminal work on the matter, [1].
>> If you want to have a different notion concerning a lesser restriction on
>> nonce reuse then you should use a different term.
>
> That paper formalises an advantage that an attacker might have over an
> ideal scheme. In the same way that block ciphers aren't ideal PRFs,
> nonce-misuse-resistant schemes aren't hitting that ideal either. RFC
> 5297 doesn't hit it, at minimum because it'll run out of counter-space
> after enough messages. AES-GCM-SIV isn't hitting it either.
>
> But that doesn't mean that they aren't practically useful.
>
> I'm not sure what an ideal NMR AEAD would look like, but it's probably
> quite different to both RFC 5297 and AES-GCM-SIV and probably looks
> like a wide-block construction. If someone can point at something they
> think does hit it, that would be interesting to me at least. (Although
> perhaps it's well trodden ground for those who are more familiar with
> the literature than I.)

AEZ looks promising to me:

http://web.cs.ucdavis.edu/~rogaway/aez/

--Andy