IETF Logo Mail Archive

Re: [Cfrg] Deoxys-II for AEAD

"Blumenthal, Uri - 0553 - MITLL" <uri@ll.mit.edu> Fri, 22 November 2019 14:48 UTC

Return-Path: <prvs=6229359e34=uri@ll.mit.edu>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 99E951200DB for <cfrg@ietfa.amsl.com>; Fri, 22 Nov 2019 06:48:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.196
X-Spam-Level:
X-Spam-Status: No, score=-4.196 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_NONE=0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o4hcJUaROrHQ for <cfrg@ietfa.amsl.com>; Fri, 22 Nov 2019 06:48:28 -0800 (PST)
Received: from llmx2.ll.mit.edu (LLMX2.LL.MIT.EDU [129.55.12.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 38D7C120867 for <cfrg@irtf.org>; Fri, 22 Nov 2019 06:48:28 -0800 (PST)
Received: from LLE2K16-MBX02.mitll.ad.local (LLE2K16-MBX02.mitll.ad.local) by llmx2.ll.mit.edu (unknown) with ESMTPS id xAMEmOFR011530; Fri, 22 Nov 2019 09:48:24 -0500
From: "Blumenthal, Uri - 0553 - MITLL" <uri@ll.mit.edu>
To: Thomas Peyrin <thomas.peyrin@gmail.com>, Vasily <shishkin_va=40tc26.ru@dmarc.ietf.org>
CC: Cfrg <cfrg@irtf.org>
Thread-Topic: [Cfrg] Deoxys-II for AEAD
Thread-Index: AQHVoPxOYUchnWzvIECG6UXueJz6aaeXOG6AgAANYIA=
Date: Fri, 22 Nov 2019 14:48:23 +0000
Message-ID: <AAA557F1-22BD-47D0-AE57-35007FDC0F87@ll.mit.edu>
References: <f7539b5a-9e39-7a98-7b6e-47e349434131@tc26.ru> <CAA0wV7St5EPgQPLMKNFBCwTETttp6T9sb8XV0=unLPmew_jysQ@mail.gmail.com>
In-Reply-To: <CAA0wV7St5EPgQPLMKNFBCwTETttp6T9sb8XV0=unLPmew_jysQ@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/10.1f.0.191110
x-originating-ip: [172.25.1.90]
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha256"; boundary="B_3657260903_1425799810"
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-11-22_02:, , signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1911140001 definitions=main-1911220132
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/jeQSWKURjkCHuPNHghV9kmBfDHE>
Subject: Re: [Cfrg] Deoxys-II for AEAD
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Fri, 22 Nov 2019 14:48:29 -0000

>    I believe we should not compare nonce-misuse resistant and nonce-respecting schemes. 

Agreed. 

>    Actually, if going for nonce-respecting design, note that Deoxys-I was
>    part of our CAESAR submission and is a nonce-respecting mode.

And in general, I frown upon using a nonce-respecting design - unless one can *guarantee* there will be no misuse.

    
    Le ven. 22 nov. 2019 à 14:19, Vasily
    <shishkin_va=40tc26.ru@dmarc.ietf.org> a écrit :
    >
    > Hi all!
    >
    > Please consider this comparison of Deoxys-II and the MGM AEAD mode, discussed at the IETF 105 CFRG:
    > https://datatracker.ietf.org/meeting/105/materials/slides-105-cfrg-introducing-mgm-multilinear-galois-mode, see slides 11 and 14.
    >
    > MGM does not have a nonce-misuse resistant mode - but because of that the message can be processed online before waiting for the whole message and, moreover, it allows precomputations.
    >
    > Also MGM allows crypto agility, since it is a general AEAD-mode that can be used with any block cipher, not limited to less studied (and not standardized) tweakable block ciphers, unlike Deoxys-II.
    >
    > Cheers,
    > Vasily, TC 26
    > _______________________________________________
    > Cfrg mailing list
    > Cfrg@irtf.org
    > https://www.irtf.org/mailman/listinfo/cfrg
    
    _______________________________________________
    Cfrg mailing list
    Cfrg@irtf.org
    https://www.irtf.org/mailman/listinfo/cfrg

v2.23.0 | Report a Bug | By Email