Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document

  Hi Shay,

  Would you agree that AEAD_AES_256_GCM_SIV provides no more
security than AEAD_AES_128_GCM_SIV? I say this because the
authentication key is 128-bits regardless (and authentication
is arguably more important than encryption) and when using a
256-bit encryption key the "record encryption key" can only
take on 2^128 values.

  If there a benefit to the 256-bit variant over the 128-bit
one? I may be misunderstanding something.

  regards,

  Dan.

On Mon, March 28, 2016 8:41 am, Shay Gueron wrote:
> Hi Yoav,
>
> The number of nonces is not limited by 2^32.
>
> What is limited by this number is the maximum number of blocks per nonce
> in
> a single message. Exactly as CTR (and AES-GCM), and for the same reason:
> there are only 32 bits in a 128-bit block, that are left to increment  a
> counter.
>
> On the other hand, since a new key is derived each time from the IV (and
> the encryption key), GCM-SIV can be used, with a given key, practically an
> "unlimited" number of times.
>
> This details is different from the CCS paper and the (later) proposed
> spec.
>
> Thanks, Shay
>
>
>
> 2016-03-28 18:22 GMT+03:00 Yoav Nir <ynir.ietf@gmail.com>:
>
>>
>> > On 28 Mar 2016, at 5:34 PM, Paterson, Kenny
>> <Kenny.Paterson@rhul.ac.uk>
>> wrote:
>> >
>> > Dear CFRG,
>> >
>> > Shay, Adam and Yehuda have asked the CFRG chairs whether their draft
>> for
>> > AES-GCM-SIV can be adopted as a CFRG document. We are minded to do so,
>> but
>> > first wanted to canvass members of the group for their opinions on
>> taking
>> > this step.
>>
>> +1: definitely take this step.
>>
>> That said, I think the current document is missing a convincing
>> motivation. The security considerations section talks about randomly
>> choosing nonces and limits the number of such nonces that can safely be
>> randomly generated to 2^32. This makes sense, but for most uses (TLS,
>> IPsec, SSH) we can use a non-random nonces (a counter; an LFSR if you
>> want
>> to get fancy; DES-encrypting a counter if you want to get really fancy).
>> Iâd be happier if there was an example where a counter is not
>> practical.
>>
>> Yoav
>>
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> https://www.irtf.org/mailman/listinfo/cfrg
>>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>