Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications

[Aaron Zauner <[e-mail]>]

Hi,

> On 15 Apr 2016, at 23:13, Gueron, Shay <[e-mail]> wrote:
> This means the following: repeating a nonce will not leak any information except if the same nonce and the same message is encrypted. In that case, an adversary could only know that the two identical message were encrypted (this cannot be avoided in any deterministic scheme).
> 
> Of course, there are limits to the number of times messaged can be encrypted with the same key. The security margins of the CCS2015 paper (original scheme) were proven there.
> 
> The CFRG submission extends the number of times that a single key (either 128 or 256 bits) can be used - and gets better bounds - at the cost of extra key expansion, as specified (we will publish the improved bounds).

Thanks for the clarification on that part.

> However, if a user chooses to use the scheme to send many (e.g., ~2^48) messages while always repeating the same nonce, then AES-GCM-SIV simply reduces to the GCM-SIV of the CCS2015 paper (and the synthetic IV's will, at high probability, collide). This is inevitable under such a "nonce abuse" scenario. Basically, this case would behave similarly to AES-GCM with a random 96-bit nonce, used ~2^48 with the same key.

Ok, so I did understand this correctly in the first place. That's actually of some concern to me, we've seen some implementations (most Cavium based, AFAICT) in the wild that use random 96-bit nonces with AES-GCM [0], some actually repeat them [1]. Likewise it's probable that implementers may err with AES-GCM-SIV and repeat messages under the same nonce ~2^48 times in some scenarios.

> What else can be expected?

The explanation you provided above (w.r.t. repeating messages under a single nonce ~2^48 times) is quite sufficient, may I suggest it gets added to the security consideration section so implementers might not repeat the same mistake with this particular design?

Thanks for your time & feedback,
Aaron

[0] https://www-01.ibm.com/support/docview.wss?uid=swg21979604
[1] https://kb.radware.com/Questions/SecurityAdvisory/Public/Security-Advisory-Explicit-Initialization-Vector-f