Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications

[Taylor R Campbell <[e-mail]>]

   Date: Mon, 18 Apr 2016 09:21:56 +0200
   From: Fedor Brunner <[e-mail]>

   Adam Langley:
   > But there are situations where nonce management is a problem (i.e.
   > where there are multiple machines encrypting with a single key) and,
   > for that, I think AES-GCM-SIV is pretty attractive because one can
   > reasonably use a random nonce.

   https://cr.yp.to/papers.html#xsalsa

   XSalsa20 is Salsa20 cipher with nonce extended to 192 bits. So there is
   no need to manage nonces, they can be generated with RNG. Could you
   please describe applications where you would prefer AES-GCM-SIV over
   XSalsa20+Poly1305

For NaCl crypto_secretbox_xsalsa20poly1305, nonce reuse -- e.g., due
to a buggy random number generator -- is catastrophic: an eavesdropper
learns the xor of two unknown-plaintext messages, or the content of
one unknown-plaintext message given one known-plaintext message, and
can forge arbitrarily many future messages.

For AES-GCM-SIV, nonce reuse enables the attacker to distinguish
duplicate messages from distinct messages, but is not otherwise
harmful.

Resistance to nonce reuse for AEAD is part of why there is an entire
AES-style crypto competition dedicated to AEAD schemes, CAESAR
<https://competitions.cr.yp.to/caesar.html>.  AES-GCM-SIV was not
submitted because it was put together too recently.

The creators of AES-GCM-SIV and chairs of the CFRG evidently decided
that it would be better to sidestep the competition and endorse crypto
that is, lacking hardware support, either unusably slow or vulnerable
to timing side channels, recommending it for general-purpose use on
the internet.

It's easy to say `all the hardware now supports it'.  It's much harder
to audit all the applications you're using to confirm that they
actually take advantage of the hardware support across umpteen layers
of software abstractions and do not render your keys vulnerable to
extraction by someone over the internet with a watch.