IETF Logo Mail Archive

Re: [Cfrg] AES-GCM-SIV with a new key hierarchy

Aaron Zauner <azet@azet.org> Sun, 26 June 2016 08:08 UTC

Return-Path: <azet@azet.org>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6ED8912B041 for <cfrg@ietfa.amsl.com>; Sun, 26 Jun 2016 01:08:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.7
X-Spam-Level:
X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=azet.org
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fV3it1mFOhMz for <cfrg@ietfa.amsl.com>; Sun, 26 Jun 2016 01:08:02 -0700 (PDT)
Received: from mail-pa0-x233.google.com (mail-pa0-x233.google.com [IPv6:2607:f8b0:400e:c03::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D33712B02C for <cfrg@ietf.org>; Sun, 26 Jun 2016 01:08:02 -0700 (PDT)
Received: by mail-pa0-x233.google.com with SMTP id hl6so49617075pac.2 for <cfrg@ietf.org>; Sun, 26 Jun 2016 01:08:02 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=azet.org; s=gmail; h=subject:mime-version:from:in-reply-to:date:cc:message-id:references :to; bh=IYjyaIJN6QXIWj/pDQVLcnY8C8NncqGfetosiwsvYWc=; b=ROmWjaUolVZzn3TmdG7Gc59hVmg7Fm79mNhD9+VkKBcBdF5FaK0Uhu2ZeEp3B9MTz4 AoavlSX0G1xOiBRA0E0U3nHvnJTMUfKXIIxqFDMasIPAYZIgRpyb0tGnq5GIGngfA2ma ythx/MUM2V5TZtMst5OAY6TYi5dLs6+OzSHDQ=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:mime-version:from:in-reply-to:date:cc :message-id:references:to; bh=IYjyaIJN6QXIWj/pDQVLcnY8C8NncqGfetosiwsvYWc=; b=TtVIUa4Sfa7mxAcCWBa2fxQdzZAUadKEK/xHIq1cekRxpEXfH+HbCgofIE58EBoxZP ogM5siTzRl13OZCOleEUBofpQQo6FomU6LJyHrn35RfqqNkoMczcu6XdRtdNsiOqpBQe YU6L2C37gukZ1j9TUgpTPMyMAklCGV7sU5iXdhGHUagXr9dQmaAL2opDpHfcke6le0gI dqU/0EsCAaWL3+2sXIgaLwEgnrdejNhfWw2JofnsY+d3AXQzn4NUx5pVvPrZzA/aYxsx XUfLH79zFjkmwwGZZhlZD2FjTOAmNWtnpEvo1hUpekeHs/4bhN4deSHcclc6NhRUj2Fy TBnA==
X-Gm-Message-State: ALyK8tK0McgQY8bCdIUTXjo8LcVpXHI9KAYKm9Wr9/Q1OTOp18LtmFK70WtdIL+a1uf4Yg==
X-Received: by 10.66.65.109 with SMTP id w13mr22719631pas.142.1466928481563; Sun, 26 Jun 2016 01:08:01 -0700 (PDT)
Received: from [192.168.1.127] ([36.83.171.89]) by smtp.gmail.com with ESMTPSA id d65sm4168028pfa.45.2016.06.26.01.07.50 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 26 Jun 2016 01:08:00 -0700 (PDT)
Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\))
Content-Type: multipart/signed; boundary="Apple-Mail=_33F6D7DF-3582-4C97-A71C-D0F2451069F5"; protocol="application/pgp-signature"; micalg="pgp-sha512"
X-Pgp-Agent: GPGMail 2.6b2
From: Aaron Zauner <azet@azet.org>
In-Reply-To: <em85e6ab2a-6a3c-4b2e-986d-2e44c2965663@sgueron-mobl3>
Date: Sun, 26 Jun 2016 16:07:36 +0800
Message-Id: <1D6C8C6D-8D82-43D4-A1B9-800C493E6BD0@azet.org>
References: <em85e6ab2a-6a3c-4b2e-986d-2e44c2965663@sgueron-mobl3>
To: "Gueron, Shay" <shay.gueron@gmail.com>
X-Mailer: Apple Mail (2.3112)
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/p30Dz3ra1hpAqOzXzXtwdzZU9WI>
Resent-From: alias-bounces@ietf.org
Resent-To: <>
Cc: Yehuda Lindell <Yehuda.Lindell@biu.ac.il>, "cfrg@ietf.org" <cfrg@ietf.org>, Adam Langley <agl@google.com>
Subject: Re: [Cfrg] AES-GCM-SIV with a new key hierarchy
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Sun, 26 Jun 2016 08:08:03 -0000

Hi,
> On 25 Jun 2016, at 01:10, Gueron, Shay <shay.gueron@gmail.com> wrote:
> 
> An alternative would be to incorporate the nonce from the beginning, during the derivation of K, H from MK. This will modify the record encryption key and also the hash key per each nonce. In that case the extra derivation of the record encryption key (per nonce) could be skipped (but also could be not done).

Could you clarify on that paragraph? e.g. with pseudocode?

Incorporating the nonce in the MK derivation step makes sense to me.

But; I don't fully grasp the last part of this paragraph; if you skip the extra derivation per record encryption key per nonce you lose nonce-MR?! Given the nonce is incorporated in the MK derivation step, this isn't an issue, but I'm not 100% sure what your suggestion here is.

Thanks,
Aaron

v2.23.0 | Report a Bug | By Email