Re: [Cfrg] Updated bounds in AES-GCM-SIV paper

[Adam Langley <[e-mail]>]

On Wed, Jul 26, 2017 at 5:04 AM, Yannick Seurin
<[e-mail]> wrote:
> We believe that the CFRG specification (especially Section 9) should be
> updated as well to reflect the new security analysis. Recommended usage
> limitations for an AEAD scheme (such as the maximal number of messages that
> can be encrypted with the same key) should be based on the maximal message
> length allowed by its specification (currently, 2^{32} 128-bit blocks). More
> fine-grained recommendations (such as "if the maximal message length in an
> application is 2^m and the maximal number of nonce repetitions is R, then
> the maximal number of messages that can be encrypted with the same key can
> be pushed to XXX") are likely to create confusion and incur implementations
> errors. For AES-GCM-SIV with randomly generated nonces (which has been put
> forward by the designers as the preferred way of generating nonces when no
> state can be saved by encrypting devices), this means that no more than
> 2^{30} messages should be encrypted with the same key, which contrasts with
> the recommended limit of 2^{50} given (without context) in Section 9 of the
> CFRG specification and in the abstract of [2].

While the maximal message length of AES-GCM-SIV is very large, we do
not think it useful to limit the total number of messages based on
it. Using such large messages is very rare (at best) and unwise with
any AEAD: large messages pressure consumers to process plaintext
before the whole message has been received and authenticated, because
buffering would be so costly.

We have just published -06, which contains updates in response to
several reviewer's feedback and also contains updated guidance
on the maximum number of messages for the case where the
maximum number of nonce repeats is 256 (which covers choosing nonces
randomly):

2^29 messages, where each plaintext is at most 1GiB
2^35 messages, where each plaintext is at most 128MiB
2^49 messages, where each plaintext is at most 1MiB
2^61 messages, where each plaintext is at most 16KiB


Cheers

AGL