Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document

On Wed, March 30, 2016 10:24 pm, Watson Ladd wrote:
> On Wed, Mar 30, 2016 at 10:09 PM, Dan Harkins <dharkins@lounge.org> wrote:
>>
>>
>> On Wed, March 30, 2016 8:40 pm, Tony Arcieri wrote:
>>> On Wed, Mar 30, 2016 at 6:56 PM, denis bider <ietf-cfrg@denisbider.com>
>>> wrote:
>>>
>>>> I believe Dan's point was that AES256-GCM-SIV uses a 128-bit tag to
>>>> derive
>>>> the final encryption key.
>>>>
>>>
>>> No?
>>>
>>> 4.  Encryption
>>>
>>>    AES-GCM-SIV encryption takes a 16-byte authentication key, a 16- or
>>>    32-byte AES key, a 128-bit nonce, and arbitrary-length plaintext and
>>>    additional data inputs.  It outputs an authenticated ciphertext that
>>>    will be 16 bytes longer than the plaintext.
>>
>>   Not sure what you mean by "No?".
>>
>>   My point was that regardless of whether it's the 128- or 256-bit
>> option the _authentication key_ used is only 128-bits; and, when
>> using the 256-bit option the "record encryption key" can only take
>> on 2^128 values.
>>
>>   So, if the effective authentication and encryption keys being used
>> in the cipher mode are always 128-bits then the 256-bit option does
>> not provide any more security than the 128-bit option. And if that's
>> the case then there is no reason to have AEAD_AES_256_GCM_SIV. Right?
>
> Let's try to do some math here. Standard PRP conjectures say that
> AES_k(0), AES_k(1) for k 256 bits is indistinguishable from the values
> of a permutation chosen uniformly at random with success probability
> q/2^256 where q is some computation measure. PRP->PRF says that with
> advantage at most 2^{-128} this is indistinguishable from two random
> values. So the distinguishability of the resulting key from a random
> 256 bit key is q/2^256+1/2^128. It's true that there is a 1/2^128 in
> the answer, but it isn't multiplied by q.

  OK, so what you're saying is there's 2^256 - 2^128 possible
values, not 2^128 possible values. Right?

  Got it. So I retract my statements.

  Dan.

>>
>>   regards,
>>
>>   Dan.
>>
>>
>>
>>> --
>>> Tony Arcieri
>>>
>>
>>
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> https://www.irtf.org/mailman/listinfo/cfrg
>
>
>
> --
> "Man is born free, but everywhere he is in chains".
> --Rousseau.
>