Re: [Cfrg] The new submission "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption"

" We note that POLYVAL(H, X_1, X_2, ...) is equal to

   ByteSwap(GHASH(x*H, ByteSwap(X_1), ByteSwap(X_2), ...)), where
   ByteSwap is a function that converts a field element to a 128-bit
   string, reverses the order of the bytes, and interprets the result as
   a field element again."

Well done! That's a nice property to help adaption.

Any similar submissions in the CAESAR competition that are worth
considering by the CFRG?

Cheers
Björn

On Sun, Mar 6, 2016 at 4:50 AM, Shay Gueron <shay.gueron@gmail.com> wrote:
> Hello CFRG,
>
>
>
> We would like to draw your attention to our new submission draft entitled
> “AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption”. Posted on
> https://www.ietf.org/internet-drafts/draft-gueron-gcmsiv-00.txt
>
>
>
> The submission specifies two authenticated encryption algorithms that are
> nonce misuse-resistant. Their performance is expected to be roughly on par
> with AES-GCM, when run on modern processors that have AES instructions.
>
>
>
> Security and performance analysis can be found in S. Gueron and Y. Lindell.
> GCM-SIV: Full Nonce Misuse-Resistant Authenticated Encryption at Under One
> Cycle per Byte. In 22nd ACM CCS, pages 109-119, 2015.
>
>
>
> We hope that the CFRG will take this up as a working-group item.
>
>
>
> Thank you,
>
>
>
> Shay Gueron, Adam Langley, Yehuda Lindell
>
>
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>