Re: [Cfrg] Do we need a selection contest for AEAD?

Dear Uri,

Yes. We recommend to use a tag size of 128 bits for our mode, but in case a
smaller tag size \tau is required, the security claims will drop according
to \tau.

Regards,

Thomas.

---------- Forwarded message ---------
De : Blumenthal, Uri - 0553 - MITLL <uri@ll.mit.edu>
Date: sam. 20 juin 2020 à 01:51
Subject: Re: [Cfrg] Do we need a selection contest for AEAD?
To: Thomas Peyrin <thomas.peyrin@gmail.com>, Stanislav V. Smyshlyaev <
smyshsv@gmail.com>
Cc: CFRG <cfrg@irtf.org>

Can you provide/compute security bounds for truncated synthetic IV?  Some
(niche) use cases require it.

*From: *Cfrg <cfrg-bounces@irtf.org> on behalf of Thomas Peyrin <
thomas.peyrin@gmail.com>
*Date: *Friday, June 19, 2020 at 1:47 PM
*To: *"Stanislav V. Smyshlyaev" <smyshsv@gmail.com>
*Cc: *CFRG <cfrg@irtf.org>
*Subject: *Re: [Cfrg] Do we need a selection contest for AEAD?

Dear all,

I will be actually sending an RFC draft of Deoxys in the coming weeks like
I promised a few months ago (really sorry, with the COVID-19 confining with
young kids at home, I couldn't advance on it). It will contain misuse
resistant mode (with stronger guarantees than AES-GCM-SIV), leakage
resilient mode with different levels of resilience, the possiblity to
encrypt 2^124 bytes per key. We are currently analyzing the INT-RUP
security of it. All this for about the same efficiency as AES-GCM-SIV.

Regards,

Thomas.

Le sam. 20 juin 2020 à 01:32, Stanislav V. Smyshlyaev <smyshsv@gmail.com
<smyshsv@gmail..com>> a écrit :

Dear CFRG,

The chairs would like to ask for opinions whether it seems reasonable to
initiate an AEAD mode selection contest in CFRG, to review
modern AEAD modes and recommend a mode (or several modes) for the IETF.

We’ve recently had a CAESAR contest, and, of course, its results have to be
taken into account very seriously. In addition to the properties that were
primarily addressed during the CAESAR contest (like protection against
side-channel attacks, authenticity/limited privacy damage in case of nonce
misuse or release of unverified plaintexts, robustness in such scenarios as
huge amounts of data), the following properties may be especially important
for the usage of AEAD mechanisms in IETF protocols:

1) Leakage resistance.
2) Incremental AEAD.
3) Commitment AEAD (we've had a discussion in the list a while ago).
4) RUP-security (it was discussed in the CAESAR contest, but the finalists
may have some issues with it, as far as I understand).

5) Ability to safely encrypt a larger maximum number of bytes per key
(discussed in QUIC WG)..

Does this look reasonable?
Any thoughts about the possible aims of the contest?
Any other requirements for the mode?

Regards,

Stanislav, Alexey, Nick

_______________________________________________
Cfrg mailing list
Cfrg@irtf.org
https://www.irtf.org/mailman/listinfo/cfrg