Re: [Cfrg] misuse-resistant AEAD (was: Re: CFRG and thwarting pervasive montoring)

["Dan Harkins" <[e-mail]>]

On Thu, January 2, 2014 2:26 pm, Watson Ladd wrote:
> On Thu, Jan 2, 2014 at 5:06 PM, Dan Harkins <[e-mail]> wrote:
>>
>>
>> On Thu, January 2, 2014 7:31 am, Watson Ladd wrote:
>>> On Jan 2, 2014 10:03 AM, "David McGrew" <[e-mail]> wrote:
>>>> I agree.   The best solution would be an authenticated encryption
>>> algorithm that did not require a nonce as input.   An alternative which
>>> is
>>> not quite as good would be an algorithm that requires a nonce as input,
>>> but
>>> which has security that suffers only a minimal degradation if nonces
>>> are
>>> repeated.
>>>
>>> Already exists: it's called CBC mode with HMAC. IVs are random and can
>>> repeat.
>>
>>   There are still security sensitive requirements on IVs in CBC mode.
>> Namely, they have to be unpredictable to the attacker. That problem does
>> not exist with SIV. The nonce is completely arbitrary, it can be a
>> counter,
>> pseudo-random material, it can be partially derived, it can repeat or
>> not.
>>
>>   And as a formal AEAD construction SIV avoids the ad hoc nature in
>> which
>> CBC plus HMAC has been put together in the past. It also has a nice and
>> fixed API for things like passing AAD as a vector of inputs.
>
> CBC+HMAC is an instance of generic composition. So is GCM and
> Chacha/Salsa/XSalsa/Poly1305.
> What sort of device can encrypt, but not use a PRNG or count?

  It's not that the device is incapable of using a PRNG or counting, it's
that the device is using a generic composition that provides security
in a tight boundary that falls apart outside that boundary. That is
coupled with knowledge that such a device will be used and configured
and managed by humans, many of whom do not understand the
boundary, or worse they think they understand it when they don't.

  Dan.