Re: [Cfrg] RG Last Call on draft-irtf-cfrg-gcmsiv-06

[Shay Gueron <[e-mail]>]

Dear Andy,

>>> do we all agree that "consistency" is sufficient by its own?

To me, a clean and consistent specification has value. The ability to
express a mode which depends on algebraic properties, via natural algebraic
formulation, has value.
Here, by natural, I mean a*b*x^-128 in GF(2^128). Compare this to AES-GCM's
a*b*x^-127 and then pushing one "*x" into H (and pre-computing "H*x") to
actually shift it to something that can be computed efficiently.
But this is an opinion.

>>> those who choose "easy way out".
>>> because they have dedicated GHASH hardware.
As Adam had mentioned, adding AES-GCM-SIV (to gain misuse resistance) has
its cost anyway, so adding the bytes swap to that cost is not a big deal. I
think it is very good that we have the easy way out.

>>> does it have to be interwoven with specific mode specification?
In fact, one might say that it is GHASH that was interwoven with the
specific mode...

Regards, Shay


2017-09-19 12:53 GMT+03:00 Andy Polyakov <[e-mail]>:

> Hi,
>
> > I would like to re-emphase a few points (although they have been already
> > nicely stated).
> >
> > The purpose of using POLYVAL is not performance. It is "consistency".
> > The performance gains are a marginal bonus (and if they are ephemeral it
> > does not matter).
>
> So we agree that performance *gains* are marginal. Should we consider
> performance *losses* elsewhere? For example for those who choose "easy
> way out". Or have to do so, for example because they have dedicated
> GHASH hardware. But even if we take performance out of equation, do we
> all agree that "consistency" is sufficient by its own? To justify
> additional implementation/diversity costs that is. Do note that we are
> not exactly still struggling with GCM. Effectively thanks to
>
> > I proposed a way to solve this
> > (https://crypto.stanford.edu/RealWorldCrypto/slides/gueron.pdf) ,
>
> And once again, if we agree that "consistency" is sufficient by its own,
> does it have to be interwoven with specific mode specification? Isn't it
> like starting building house from *roof*? If we consider that we would
> be better off if primitives were little-endian-centric, then let's say
> that and start building *foundation*...
>