Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document

[Yoav Nir <[e-mail]>]

On 29 Mar 2016, at 8:06 AM, Adam Langley <[e-mail]> wrote:

> On Mon, Mar 28, 2016 at 8:45 PM, Yoav Nir <[e-mail] <mailto:[e-mail]>> wrote:
> And this limitation makes sense only if the nonces are chosen randomly. Otherwise we can generate 2^96 unique nonces with no problem. It does make sense if there are multiple senders and no sane way to partition the nonce space.
> 
> You're correct that the limit of 2^32 only applies when the nonces are chosen at random—the text could be clearer there.
> 
> For situations were a counter can be maintained (i.e. transport security) then I don't believe that SIV modes are called for. AES-GCM works fine.
> 
> However, a consider a situation where a number of machines are encrypting and decrypting blobs of data because the data is stored on an untrusted storage system. A scheme for distributing fractions of the nonce space to the servers is possible, but complex and fragile. Generating the nonces at random is desirable, but 2^32 encryptions just isn't very many. In this case I think AES-GCM-SIV is quite attractive.
> 
> (There are schemes like XChaCha20-Poly1305, which has a 192-bit nonce but, while fast, many CPUs have dedicated hardware for AES-GCM and that's a hard advantage for alternatives to overcome.)
> 

Ah, that’s what I figured. So it’s useful for cases where you have multiple encryptors, or even a single encryptor over a long time and multiple overwrites. So yeah, disk encryption makes sense as do some multicast VPN scenarios.

Thanks

Yoav