Re: [Cfrg] RG Last Call on draft-irtf-cfrg-gcmsiv-06

Shay Gueron <> Tue, 19 September 2017 10:19 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 9D2701320B5 for <>; Tue, 19 Sep 2017 03:19:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.698
X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id d1YXtCuId8RB for <>; Tue, 19 Sep 2017 03:19:44 -0700 (PDT)
Received: from ( [IPv6:2a00:1450:4010:c07::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id A56CE132F2E for <>; Tue, 19 Sep 2017 03:19:37 -0700 (PDT)
Received: by with SMTP id q132so3181988lfe.5 for <>; Tue, 19 Sep 2017 03:19:37 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=7weoppNUN0kiHPLJui9cliRRPBfeE69dUnEj7oOCyoA=; b=VpF6vSHLVPy1TlrOhyxOAPgmpBTj2T+9cXwYk1l8kmqg7QsPjgIzhetTtnYB6o9Y/C smrbVy/XshWmKPBmpXasWdmAl6ULbnngQMMGX5aRwHrrfQ+v9EzBe6pxSnlHm3oO1i06 u6IrR6H7B6fyU8e9mFnFF4421pW1+lUyrk4kzweghIh3O2+fgoOHbLljosrcnggXiXFn u/Qm03NF4wGUWhM0Xmn+YnhSJ1fIwr4AJPP06Ou8yHseVUQ5y84LLCrxEuKbTO7wdUxZ U580bteAsc6EgV77WJpJQ6MqNxJejrkEKx/I/I1BzBP9VNAaeOeMTwUl1r9BsGBsHxGJ C7bg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=7weoppNUN0kiHPLJui9cliRRPBfeE69dUnEj7oOCyoA=; b=TNpSwWq/hTeAFuieSp6HpsxxF/DOofSKKEpLKqERpJwpqrFQsgHJQG40K6rn9U7hgZ ju1c+eg7+oS0cUGLo02LKPpNfb2x/tS9Xatg82v5dfD8N3HSQVduRGpZbX55KeUhYhtH AXf5k5II2/6kjNv9Z7UT4vCJrqzhVKckWaXPgODxqJrTYwej3VljUuKv/CSjLcMgLvCV 0fXEusqqPGu16LXMuq1TpCHLsdh8Nm+a6CqEUqjHbwDBEMCA5m4Zwo384Y6CgX/+Ys2f g+ezrW4Otb5Ln6/c/pyYzbe2LbknU3qsIQ2xfFzKwQvrqkxHG4FkB3wA2FtHMXwbFzel xoUg==
X-Gm-Message-State: AHPjjUjIoxAn07HkBHsCHFGCl08PXvIXhUnaQTPRcXqQnG+xPeTsVaoB P83A3nUGK0ZzcSxQffz+jSkaVMVGYJjaaGmxZLQ=
X-Google-Smtp-Source: AOwi7QDcuagcqOZKhFFFruSLtcy/na2NxQzc2QF9xJxkH4PK6Q4IXgtXBVGQv29byCZAeqzjX7uMzfGaEZRwaia4rUA=
X-Received: by with SMTP id 39mr403702lfu.224.1505816375871; Tue, 19 Sep 2017 03:19:35 -0700 (PDT)
MIME-Version: 1.0
Received: by with HTTP; Tue, 19 Sep 2017 03:19:35 -0700 (PDT)
In-Reply-To: <>
References: <> <> <> <> <> <>
From: Shay Gueron <>
Date: Tue, 19 Sep 2017 13:19:35 +0300
Message-ID: <>
To: Andy Polyakov <>
Cc: "" <>, Shay Gueron <>
Content-Type: multipart/alternative; boundary="001a113fc2ee2e4eb90559883259"
Archived-At: <>
Subject: Re: [Cfrg] RG Last Call on draft-irtf-cfrg-gcmsiv-06
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 19 Sep 2017 10:19:47 -0000

Dear Andy,

>>> do we all agree that "consistency" is sufficient by its own?

To me, a clean and consistent specification has value. The ability to
express a mode which depends on algebraic properties, via natural algebraic
formulation, has value.
Here, by natural, I mean a*b*x^-128 in GF(2^128). Compare this to AES-GCM's
a*b*x^-127 and then pushing one "*x" into H (and pre-computing "H*x") to
actually shift it to something that can be computed efficiently.
But this is an opinion.

>>> those who choose "easy way out".
>>> because they have dedicated GHASH hardware.
As Adam had mentioned, adding AES-GCM-SIV (to gain misuse resistance) has
its cost anyway, so adding the bytes swap to that cost is not a big deal. I
think it is very good that we have the easy way out.

>>> does it have to be interwoven with specific mode specification?
In fact, one might say that it is GHASH that was interwoven with the
specific mode...

Regards, Shay

2017-09-19 12:53 GMT+03:00 Andy Polyakov <>:

> Hi,
> > I would like to re-emphase a few points (although they have been already
> > nicely stated).
> >
> > The purpose of using POLYVAL is not performance. It is "consistency".
> > The performance gains are a marginal bonus (and if they are ephemeral it
> > does not matter).
> So we agree that performance *gains* are marginal. Should we consider
> performance *losses* elsewhere? For example for those who choose "easy
> way out". Or have to do so, for example because they have dedicated
> GHASH hardware. But even if we take performance out of equation, do we
> all agree that "consistency" is sufficient by its own? To justify
> additional implementation/diversity costs that is. Do note that we are
> not exactly still struggling with GCM. Effectively thanks to
> > I proposed a way to solve this
> > ( ,
> And once again, if we agree that "consistency" is sufficient by its own,
> does it have to be interwoven with specific mode specification? Isn't it
> like starting building house from *roof*? If we consider that we would
> be better off if primitives were little-endian-centric, then let's say
> that and start building *foundation*...