From: "Gueron, Shay" <shay.gueron@gmail.com>
To: "Aaron Zauner" <azet@azet.org>
Date: Sun, 26 Jun 2016 08:26:12 +0000
Message-Id: <em01122224-6812-4371-a628-21d5f8515794@sgueron-mobl3>
In-Reply-To: <1D6C8C6D-8D82-43D4-A1B9-800C493E6BD0@azet.org>
User-Agent: eM_Client/6.0.24928.0
Mime-Version: 1.0
Content-Type: text/plain; format=flowed; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/lM8gttOdcr2SXDf86fSYFfs5AT4>
Resent-From: <alias-bounces@ietf.org>
Resent-To: @ietf.org
Cc: Yehuda Lindell <Yehuda.Lindell@biu.ac.il>, "cfrg@ietf.org" <cfrg@ietf.org>,
 Adam Langley <agl@google.com>
Subject: Re: [Cfrg] AES-GCM-SIV with a new key hierarchy
Precedence: list
Reply-To: "Gueron, Shay" <shay.gueron@gmail.com>

Of course - let me describe.
For simplicity, I describe the case of a 128-bit MK.

Option 1: K1 =3D E_MK (0), K2 =3D E_K1 (0)  (K1 will be used for encryption=
,=20
and K2 for the authentication)
Then continue AES-GCM-SIV as it is defined now (including a derivation=20
of a record encryption key, per nonce N)

Option 2: K1 =3D E_MK (N), K2 =3D E_K1 (N)
Then AES-GCM-SIV as it is defined now, but without an  additional=20
derivation of a record encryption key; just set K1 as the record=20
encryption key.

Note: Option 1 is merely a static "pre-derivation" (where K1, K2 can be=20
cached). Here, MK is used directly only twice.
Option 2 uses MK (directly) with each nonce. Here, the hash key also=20
depend on the nonce.

There is another option.

Option 3: K1 =3D E_MK (0), K2 =3D E_K1 (0)
Then continue AES-GCM-SIV as it is defined now (including a derivation=20
of a record encryption key, per nonce N) and also define a record hash=20
key via E_K2 (N).


These options offer different nuances, and would have a noticeable=20
performance effect only for short messages. My favorite, among these 3,=20
is Option 3 (that seems to enjoy all the benefits, at a small additional=
=20
latency).


Shay


------ Original Message ------
From: "Aaron Zauner" <azet@azet.org>
To: "Gueron, Shay" <shay.gueron@gmail.com>
Cc: "cfrg@ietf.org" <cfrg@ietf.org>; "Yehuda Lindell"=20
<Yehuda.Lindell@biu.ac.il>; "Adam Langley" <agl@google.com>
Sent: 6/26/2016 11:07:36 AM
Subject: Re: [Cfrg] AES-GCM-SIV with a new key hierarchy

>Hi,
>>  On 25 Jun 2016, at 01:10, Gueron, Shay <shay.gueron@gmail.com> wrote:
>>
>>  An alternative would be to incorporate the nonce from the beginning,=
=20
>>during the derivation of K, H from MK. This will modify the record=20
>>encryption key and also the hash key per each nonce. In that case the=20
>>extra derivation of the record encryption key (per nonce) could be=20
>>skipped (but also could be not done).
>
>Could you clarify on that paragraph? e.g. with pseudocode?
>
>Incorporating the nonce in the MK derivation step makes sense to me.
>
>But; I don't fully grasp the last part of this paragraph; if you skip=20
>the extra derivation per record encryption key per nonce you lose=20
>nonce-MR?! Given the nonce is incorporated in the MK derivation step,=20
>this isn't an issue, but I'm not 100% sure what your suggestion here=20
>is.
>
>Thanks,
>Aaron