Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications

[Andy Lutomirski <[e-mail]>]

On Thu, Apr 21, 2016 at 1:38 PM, Gueron, Shay <[e-mail]> wrote:
> OK, I did not understand what Andy meant...
>
> Indeed, for deriving the encryption in the 256-bit key case, the nonce has
> effectively 127 bits.
>
> Repeating this (127-bit) nonce degenerates the encryption to using the same
> 256-bit key.
>
> Still, the CTR mode encryption that follows, is not going to leak
> information unless the same message (with the same 127-bit IV) is encrypted.
> In such, the equality of the message is revelaed. But this is the nature of
> the deterministic processing, and this is what the nonce misuse resistance
> provides.

Then you're violating one of the basic properties that even
non-nonce-misuse-resistent schemes provide: when you encrypt two
messages using different nonces, you shouldn't reveal whether they're
the same message.  As proposed, this mode does *not* have that
property.

This isn't a probabilistic thing.  A program that uses a simple
counter as their nonce in the appropriate endianness will trigger this
for every single pair of consecutive messages.  That's a 100%
probability of information leak for a session that contains a mere 2^1
messages.

You can paper over it by saying that, in 256-bit AES mode, the nonce
is only 127 bits, but that's weird and someone's going to use it
wrong.  Given that fixing this is trivial, why not just fix it?  This
is, after all,
a mode designed to be misuse-resistant, and this design decision makes it very
easy to misuse.

--Andy