Re: [Cfrg] new authenticated encryption draft

At 11:47  -0700 2006/08/20, Hal Finney wrote:
>
>It is outside the scope of your document, but I have found from my
>disk experience that the approach in these algorithms of letting the
>AEAD algorithm manage uniqueness of IVs at the "micro scale" while the
>caller manages uniqueness at the "macro scale" can actually lead to
>very inefficient allocation of IV space. For example, with GCM taking
>an external IV contribution of 64 bits, if the caller is encrypting a
>lot of short messages in a context where it must be stateless and pass
>in a random IV contribution, it can only encrypt 2^32 such messages
>under a given key. The seemingly vast IV space is eroded to a very
>significant limitation similar to what we had in the old days of DES.

This "erosion" only happens if the requirement is that the IV be 
random and unpredictable to an attacker. Most AEAD systems don't 
require this strong guarantee, and any form of Nonce will usually do; 
the only requirement being uniqueness. So the 64 bit input, provided 
in the form of a counter, is good to the same order-of-magnitude 
limit as the block cipher itself.

(Note: I haven't looked at the new mode to verify that this is the 
case, but I think it probably is.)

I've been lightly pushing for a terminology change in this area for some time:
Use "IV" when randomness and/or unpredictability are requirements
Use "Nonce" when uniqueness is the only requirement.

Greg.

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg