[Cfrg] Do we need a selection contest for AEAD?

["Stanislav V. Smyshlyaev" <[e-mail]>]

Dear CFRG,

The chairs would like to ask for opinions whether it seems reasonable to
initiate an AEAD mode selection contest in CFRG, to review modern AEAD modes
and recommend a mode (or several modes) for the IETF.

We’ve recently had a CAESAR contest, and, of course, its results have to be
taken into account very seriously. In addition to the properties that were
primarily addressed during the CAESAR contest (like protection against
side-channel attacks, authenticity/limited privacy damage in case of nonce
misuse or release of unverified plaintexts, robustness in such scenarios as
huge amounts of data), the following properties may be especially important
for the usage of AEAD mechanisms in IETF protocols:
1) Leakage resistance.
2) Incremental AEAD.
3) Commitment AEAD (we've had a discussion in the list a while ago).
4) RUP-security (it was discussed in the CAESAR contest, but the finalists
may have some issues with it, as far as I understand).
5) Ability to safely encrypt a larger maximum number of bytes per key
(discussed in QUIC WG).

Does this look reasonable?
Any thoughts about the possible aims of the contest?
Any other requirements for the mode?

Regards,
Stanislav, Alexey, Nick