Re: [Cfrg] request for comments on "Generation of Deterministic Initialization Vectors (IVs) and Nonces"

[Peter Gutmann <[e-mail]>]

"Dan Harkins" <[e-mail]> writes:

>Let me remind everyone of SIV mode*. It's a CTR mode derivative but is
>resistant to nonce misuse. Unlike CBC, the nonce doesn't need to be
>unguessable. And it even provides a strong assurance of security if the nonce
>is reused.

Doesn't SIV require the entire message to be buffered, which makes it unusable
in streaming implementations?

[Checks]

Unless I've misinterpreted some part of Fig.3 and Fig.8 of RFC 5297, this
can't be used in a streaming implementation because the CMAC operation to
create the IV has to make a complete pass over the message before you can
start encrypting (this is also similar to a key-wrap mechanism that Colin
Plumb and I came up with for RFC 3211, although it'd need a tweak to use a
proper MAC for full integrity-protection, it was designed for non-expanding
512-byte disk sector encryption and dates from the early 1990s, so it predates
pretty much all of the work that newer modes and mechanisms are built on).
SIV is quite nice for something like 802.11, SRTP, DTLS, and others, but
unfortunately won't work as a general-purpose mechanism.

Are there any IP issues around SIV?

Peter.