Re: [Cfrg] Kravatte-SANSE

[Gilles Van Assche <[e-mail]>]

Hi Nick,

> I'm interested in this construction but I'd like to know more. What
> sort of applications do you think this function would have within the
> IETF? Would it be useful as a general replacement for PRFs in, for
> example, TLS?

Kravatte is indeed a pseudo-random function (PRF), and could be plugged
in as one, using Kravatte directly as a MAC function or to generate key
stream. Note that it has additional extension properties, i.e., it
supports sequences of strings as input and computing F(Y o X) costs only
the processing of Y if F(X) was previously computed. With the modes we
propose (-SANE, -SANSE and -WBCAE), it becomes an authenticated
encryption scheme with a range of robustness properties.

Both Kravatte-SANE and -SANSE support sessions, as previously described.
Although not a specialist in TLS, I nevertheless think that this fits
naturally in protocols that protect a stream of data like TCP. If the
protocol starts with a shared session key (as produced by, e.g., a
Diffie-Hellman variant), then the session maps to the complete stream of
data in a very simple way, with intermediate MACs, and without the need
to manage nonces. In the case of out-of-order packets like UDP, each
packet would be protected independently, and the concept of session is
less useful, though.

Kravatte-SANE relies on nonces, unless one needs only a single session
per key as in the example above. Unlike Kravatte-SANE, Kravatte-SANSE
creates a synthetic nonce in a SIV fashion for additional robustness.
Finally, Kravatte-WBCAE is a wide block cipher (WBC) that can do
authenticated encryption with minimal ciphertext expansion. (It is
functionally similar to CAESAR candidate AEZ but constructed in a very
different way.)

> Can it leverage hardware-specific instructions?

Because of the highly parallel Farfalle construction, Kravatte can take
advantage of general-purpose vector instructions like NEON, SSE or
AVX{2, 512}.

It can also exploit the SHA-3 instructions in ARMv8.2. These
instructions actually accelerate the evaluation of two Keccak-p
permutations in parallel, which Kravatte can take advantage of, thanks
to the parallelism.

Kind regards,
Gilles, for the Kravatte designers