Re: [Cfrg] RG Last Call on draft-irtf-cfrg-gcmsiv-06

Dear all,

We have made a version of our work available at

http://www.cs.ucsb.edu/~tessaro/papers/BHT17.pdf

We have extended the bounds to cover a large class of KDFs. In
particular, our bound covers the KDF in the current AES-GCM-SIV
proposal, as well as the simpler one we suggested in an earlier
e-mail, which is the one from the initial AES-GCM-SIV proposal.

Regards,
Priyanka Bose
Viet Tung Hoang
Stefano Tessaro

On Mon, Oct 2, 2017 at 10:29 PM, Yehuda Lindell
<Yehuda.Lindell@biu.ac.il> wrote:
> Dear all,
>
> The paper by Bose, Hoang and Tessaro (BHT) shows that AES-GCM-SIV has excellent multi-user security bounds (according to the authors, this is the first scheme that has been shown to have the property that the multi-user security is essentially as good as the single user security). Thus, this is great support for AES-GCM-SIV as a standard.
>
> Conceptually, the reason why AES-GCM-SIV gets much better multi-user security than other modes is due to the continual key derivation that ensures that even if two users have the same key, the damage is minimal since they must also use the same IV in order to face a problem.
>
> The authors also show that the ORIGINAL key derivation mode proposed for AES-GCM-SIV is actually good enough (i.e., simple key derivation via CTR mode, and without truncation). They say that it is more efficient, and this is true theoretically. However, practically, when using AES-NI, the cost of 2 additional encryptions for the key derivation is almost zero due to the pipeline (2 more cycles), and negligible even for reasonably small messages. Especially, since these are shadowed by the key expansion that is required in any case.
>
> At the time, there were objections to the plain CTR derivation method, during the CFRG discussions (e.g., due to the fact that for 256-bit keys, this rules out the possibility of keys of the form K||K). Instead, an OCB style derivation was promoted. Subsequently, we ended up with the current truncated CTR method. We therefore propose to not change the key derivation method (again).
>
> Thanks,
>
> Shay, Adam and Yehuda
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>

-- 
Stefano Tessaro
Assistant Professor of Computer Science
University of California, Santa Barbara
http://cs.ucsb.edu/~tessaro/