Re: [Cfrg] AES-GCM-SIV security of the additional data

["Paterson, Kenny" <[e-mail]>]

Hi Adam,

Thanks for the clarification. My remarks were based on the scheme as presented by Shay at Vienna; there, he introduced the misconception that two separate keys were involved; he did not clarify this during questioning (see the minutes). 

Of course the draft is definitive document and it's good that it presents the normal API. 

Cheers,

Kenny

Sent from my iPhone

> On 25 Jun 2016, at 02:43, Adam Langley <[e-mail]> wrote:
> 
> On Fri, Jun 24, 2016 at 6:24 AM, Paterson, Kenny
> <[e-mail]> wrote:
>> On a related point, my view is that it is a disbenefit that the
>> AES-GCM-SIV proposal has two separate keys (one for encryption, the other
>> for authentication) as inputs. That's not the AEAD interface that we have
>> raised our implementers on. I raised this point at the CFRG meeting in
>> Vienna back in May. Simply concatenating the two keys in the current
>> proposal into one would address this issue, but not the one you raise (if
>> I understand it correctly).
> 
> The two keys are already concatenated in the draft, or else I
> misunderstood your point:
> https://tools.ietf.org/html/draft-irtf-cfrg-gcmsiv-01#section-6
> 
> "Since the definition of an AEAD requires that the key be a single
> value we define AEAD_AES_128_GCM_SIV to take a 32-byte key: the first
> 16 bytes of which are used as the authentication key and the remaining
> 16 bytes are used as the AES key. Likewise AEAD_AES_256_GCM_SIV takes
> an 48-byte key: the first 16 bytes are again the authentication key
> and the remaining 32 bytes is the AES key."
> 
> 
> Cheers
> 
> AGL
> 
> -- 
> Adam Langley [e-mail] https://www.imperialviolet.org