Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

> Sorry to continue this discussion, but I'm still dubious on the consideration
> of AES-GCM-SIV. I think there are two questions here:
> - the first one is why do we need to push an AEAD now, while the CAESAR
> competition will lead to a selected portfolio in a few years ?

Because we don’t want to wait for “a few years”.

> - the second is if we really want to have an AEAD now, why looking at
> AES-GCM-SIV only, while there are candidates from the CAESAR competitions
> (that have probably been much more analysed than AES-GCM-SIV and thus present
> a direct important advantage) ?

I doubt the other candidates have been “much more analysed”.  Also, (a) I’m
happy with the analysis that accompanies AES-GCM-SIV, and (b) I’m well-aware
of the limitations of “security proofs” that more and more algorithms are
coming with nowadays.

But if you see a problem with GCM-SIV security proofs (or assumptions
they’re based on), by all means speak up.

> Why do we need to wait for the end of CAESAR competition before considering
> CAESAR candidates instead of AES-GCM-SIV ? I believe we should at least take a
> short look at the current algorithms available now, and not only AES-GCM-SIV ?

Fine with me. Take a short look and write a draft for another algorithm.
Explaining what properties you need that are missing  in GCM-SIV would be
nice too.