Re: [Cfrg] CCM

-----BEGIN PGP SIGNED MESSAGE-----

I wrote:
>  - the security proof depends on the fact that the nonce N is independent
>    of any previous ciphertext. The draft only says that it must be
>    unique. Actually, it's not sufficient that it be unique: it must
>    also be impossible for an attacker to influence the choice of nonce.

I take this back; the proof only depends on the nonce being independent
of the cipher inputs used to compute the MAC (which are hidden from the
adversary), not the ciphertext. So the nonce does only need to be unique
(unless I've missed something else).

- -- 
David Hopwood <david.hopwood@zetnet.co.uk>

Home page & PGP public key: http://www.users.zetnet.co.uk/hopwood/
RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5  0F 69 8C D4 FA 66 15 01
Nothing in this message is intended to be legally binding. If I revoke a
public key but refuse to specify why, it is because the private key has been
seized under the Regulation of Investigatory Powers Act; see www.fipr.org/rip

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBPXV3HjkCAxeYt5gVAQEfagf/fUcY3l4C2nYTp/japAzt4ixp4/n09bqr
Bh7bHDQCzOEsuIk032V0pOSO56xI7i/csIuEbR1LV/1FSG8tkGz4j82HS0qhEUST
MuQRJvjCtChdAsSbegJBJwtkI+zKwaG/r6OGCb8WfaCrzbcSXzjGbjgFtQVGKQYf
Qon7WJH3GFPmYjMMAP+pTe3yPJ/9LJzRRxD8g8LFTxMl1oR/Vx/21lpnzBD1dZ72
9mK/zFhO/A/uHUA3Wmeh2smUUxbYrKw2gsM/dpsts+07R9sU+biDMxowfUixXQYp
4WcubzgwpaomBVuADw43LW9+DLVlUcI/EyW5PK4JRTxKp585YZIG4A==
=4QYY
-----END PGP SIGNATURE-----
_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg