Subject: Re: [Cfrg] AES-GCM-SIV with a new key hierarchy
From: "Gueron, Shay" <[email-masked]>
To: "Aaron Zauner" <[email-masked]>
Cc: Yehuda Lindell <[email-masked]>, "[email-masked]" <[email-masked]>, Adam Langley <[email-masked]>
Date: Sun, 26 Jun 2016 08:26:12 +0000
List-Id: Crypto Forum Research Group <cfrg.irtf.org>

Of course - let me describe.
For simplicity, I describe the case of a 128-bit MK.

Option 1: K1 = E_MK (0), K2 = E_K1 (0)  (K1 will be used for encryption, 
and K2 for the authentication)
Then continue AES-GCM-SIV as it is defined now (including a derivation 
of a record encryption key, per nonce N)

Option 2: K1 = E_MK (N), K2 = E_K1 (N)
Then AES-GCM-SIV as it is defined now, but without an  additional 
derivation of a record encryption key; just set K1 as the record 
encryption key.

Note: Option 1 is merely a static "pre-derivation" (where K1, K2 can be 
cached). Here, MK is used directly only twice.
Option 2 uses MK (directly) with each nonce. Here, the hash key also 
depend on the nonce.

There is another option.

Option 3: K1 = E_MK (0), K2 = E_K1 (0)
Then continue AES-GCM-SIV as it is defined now (including a derivation 
of a record encryption key, per nonce N) and also define a record hash 
key via E_K2 (N).

These options offer different nuances, and would have a noticeable 
performance effect only for short messages. My favorite, among these 3, 
is Option 3 (that seems to enjoy all the benefits, at a small additional 
latency).

Shay

------ Original Message ------
From: "Aaron Zauner" <[email-masked]>
To: "Gueron, Shay" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>; "Yehuda Lindell" 
<[email-masked]>; "Adam Langley" <[email-masked]>
Sent: 6/26/2016 11:07:36 AM
Subject: Re: [Cfrg] AES-GCM-SIV with a new key hierarchy

>Hi,
>>  On 25 Jun 2016, at 01:10, Gueron, Shay <[email-masked]> wrote:
>>
>>  An alternative would be to incorporate the nonce from the beginning, 
>>during the derivation of K, H from MK. This will modify the record 
>>encryption key and also the hash key per each nonce. In that case the 
>>extra derivation of the record encryption key (per nonce) could be 
>>skipped (but also could be not done).
>
>Could you clarify on that paragraph? e.g. with pseudocode?
>
>Incorporating the nonce in the MK derivation step makes sense to me.
>
>But; I don't fully grasp the last part of this paragraph; if you skip 
>the extra derivation per record encryption key per nonce you lose 
>nonce-MR?! Given the nonce is incorporated in the MK derivation step, 
>this isn't an issue, but I'm not 100% sure what your suggestion here 
>is.
>
>Thanks,
>Aaron