Re: [Cfrg] RG Last Call on draft-irtf-cfrg-gcmsiv-06

[Andy Polyakov <[e-mail]>]

>>>> do we all agree that "consistency" is sufficient by its own?
> 
> To me, a clean and consistent specification has value.

I don't deny its value, question was it is sufficient [to justify
additional implementation/diversity costs].

>>>> those who choose "easy way out". 
>>>> because they have dedicated GHASH hardware. 
> As Adam had mentioned, adding AES-GCM-SIV (to gain misuse resistance)
> has its cost anyway,

Yes, and assertion is that it could have been *lower* if it was
formulated with GHASH and standard CTR.

> so adding the bytes swap to that cost is not a big
> deal. I think it is very good that we have the easy way out.

As already mentioned, there is another actor in the drama, tweaked CTR.
If byte swap for GHASH can be considered acceptable (what's your
estimate by the way?), question about alternative CTR remains. Thing is
that if it's built upon single-block function, its performance would be
*significantly* lower in comparison to dedicated optimized CTR
subroutine. Well, one can mitigate it by deploying ECB, but not all
[OpenSSL] modules have dedicated ECB subroutine...

>>>> does it have to be interwoven with specific mode specification?
> In fact, one might say that it is GHASH that was interwoven with the
> specific mode...  

Fair point. But was it optimal choice? I mean does it actually mean that
it has to be that way even now and for all eternity? :-)

Cheers.