Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications

[Michael StJohns <[e-mail]>]

On 4/15/2016 12:06 PM, Gueron, Shay wrote:
> This means that repeating a nonce will not leak any information except 
> if the same nonce and the same message is encrypted. In that case, an 
> adversary could only know that the two identical message were 
> encrypted (this cannot be avoided in any deterministic scheme). 

Is there any other scheme currently in use in our protocols (TLS, IPSEC, 
etc) that has the property that identical messages under the same 
key/nonce (or key IV) are encrypted identically?

I've been reading this thread only intermittently and perhaps I missed 
the discussion, but the above property seems to be a "bad thing"(tm) in 
the general scheme of things.  Perhaps it can be mitigated by specific 
protocols with specific techniques but that seems to be contrary to the 
idea that this is an idiot-proof (in terms of implementation) 
improvement over AES-GCM itself.

Mike