Re: [CFRG] Review of draft-irtf-cfrg-aead-limits-01

[Felix Günther <[e-mail]>]

Hi John,

Thanks for your further helpful comments. For reference, we're tracking
them at https://github.com/cfrg/draft-irtf-cfrg-aead-limits/issues/28.
Let me respond to a few points here already.


> -- It would be good if the document states that it only focuses on "single forgery attacks"

The document actualy considers multiple forgeries (parameter v accounts
for their number) and was in parts motivated by work on the robustness
of protocols like DTLS and QUIC to those. We'll make this clearer.


> -- I think the document should briefly explain the assumptions about the algorithms. In [GCMProofs] it is e.g. assumed that AES is a PRP. Future cryptanalysis that does not make these ideal assumptions could make the limits worse.
>
> -- The document should make it clear that formulas for CA and IA (at least for GCM) are upper bounds. Future analysis could make the limits better. That they are just bounds also make any direct comparision between algorithms tricky as some bounds might be tigher than others.

There's indeed a subtle interplay between bounds and models/assumptions.
E.g., for some bounds are indeed tight/cannot be improved _in the given
model_, and then things depend on which assumptions one is willing to
make.  We will expand on this, although there are obviously limits to
what can be reasonably discussed in this document.


> - The draft briefly mention that small limits lead to denial-of-service attacks. The DTLS 1.3 draft does that.

Yes, for small limits DoS attacks have to be weighed. For DLTS 1.3 I
assume you refer to Appendix B.3, whose analysis supports the view that
small limits as for AES-CCM make such AE schemes unsuitable for general
use when DoS attacks are a concern.


Cheers,
Felix