Re: [Cfrg] SIV for non-AES ciphers first draft

Neil Madden <neil.e.madden@gmail.com> Mon, 26 November 2018 09:41 UTC

Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 12.1 \(3445.101.1\))
From: Neil Madden <neil.e.madden@gmail.com>
In-Reply-To: <A7D10A25-1DC1-4633-A745-64EF35BD1F8B@usfca.edu>
Date: Mon, 26 Nov 2018 09:41:38 +0000
Cc: cfrg@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <82273196-5DAC-4127-90B2-E7C3874A84D8@gmail.com>
References: <0D91AF7A-F26F-4E20-A009-B7D75BF8107D@gmail.com> <A7D10A25-1DC1-4633-A745-64EF35BD1F8B@usfca.edu>
To: Paul Lambert <plambert@usfca.edu>
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/rl3PbDjsxwd8EfLSeaR6LOAKZQ8>
Subject: Re: [Cfrg] SIV for non-AES ciphers first draft
Precedence: list

I’m not wedded to HMAC-SHA256, so Blake2 is an attractive option. I went with HMAC-SHA256 because it seems good enough and fairly ubiquitous.

If we went for Blake2 then there are a number of decisions to be made:

1. Do we pick Blake2b or Blake2s? My mild preference would be for the s variant as both cipher and MAC then work well on 32-bit systems and it requires less RAM.

2. Do we go for 256-bit auth tag (as now), or take advantage of Blake2’s variable length output to produce a 192-bit tag, exactly matching the nonce required for XChaCha? A 256-bit auth tag is probably excessive for most uses.

3. Do we use Blake2’s native keyed hash support or use HMAC-Blake2? See [1] for some arguments in favour of using HMAC, but then keyed Blake2 is (presumably) faster.

[1] http://noiseprotocol.org/noise.html#hash-functions-and-hashing

— Neil

> On 26 Nov 2018, at 08:07, Paul Lambert <plambert@usfca.edu> wrote:
> 
> On the draft …
> Given the benefits of Blake2 and it’s similar construction to ChaCha, why not use Blake2 instead of HMAC-SHA-256?
> 
> Paul
> 
> 
>> On Nov 22, 2018, at 9:22 AM, Neil Madden <neil.e.madden@gmail.com> wrote:
>> 
>> I have now uploaded a (very rough) first draft describing how to extend the SIV mode of operation to non-AES ciphers and MACs, as previously discussed on this list.
>> 
>> The I-D is available here: https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dmadden-2Dgeneralised-2Dsiv_&d=DwIGaQ&c=qgVugHHq3rzouXkEXdxBNQ&r=oIg4FfS8P761BlhMPJ2ys3IvSyH4XQ12Mbj_mXrCAJs&m=5WQpmA8deCCE8ehAcBhR-0SwNWDHfNA7dEo1IVxbNUM&s=Bs8DJzvOJ6KwhzN8Yti0sRCdOT5r02Ho7m3qmNKJpuI&e=
>> The source is on Github here: https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_NeilMadden_draft-2Dmadden-2Dgeneralised-2Dsiv&d=DwIGaQ&c=qgVugHHq3rzouXkEXdxBNQ&r=oIg4FfS8P761BlhMPJ2ys3IvSyH4XQ12Mbj_mXrCAJs&m=5WQpmA8deCCE8ehAcBhR-0SwNWDHfNA7dEo1IVxbNUM&s=qgsdZqOvSNNunN3u9v69TfSUfrP3mW7OV865Ui6qq8E&e=
>> 
>> Feedback welcome. Hopefully I’ve managed to wrestle xml2rfc to produce the right output.
>> 
>> Kind regards,
>> 
>> Neil Madden
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.irtf.org_mailman_listinfo_cfrg&d=DwIGaQ&c=qgVugHHq3rzouXkEXdxBNQ&r=oIg4FfS8P761BlhMPJ2ys3IvSyH4XQ12Mbj_mXrCAJs&m=5WQpmA8deCCE8ehAcBhR-0SwNWDHfNA7dEo1IVxbNUM&s=g8oGz_kyMuTTp26sl6yblddFB_S1C5LiXRE9KKXhvxw&e=
>

[Cfrg] SIV for non-AES ciphers first draft Neil Madden
Re: [Cfrg] SIV for non-AES ciphers first draft Paul Lambert
Re: [Cfrg] SIV for non-AES ciphers first draft Neil Madden
Re: [Cfrg] SIV for non-AES ciphers first draft Neil Madden
Re: [Cfrg] SIV for non-AES ciphers first draft Salz, Rich
Re: [Cfrg] SIV for non-AES ciphers first draft Paterson, Kenny
Re: [Cfrg] SIV for non-AES ciphers first draft Tony Arcieri
Re: [Cfrg] SIV for non-AES ciphers first draft Tony Arcieri
Re: [Cfrg] SIV for non-AES ciphers first draft Neil Madden
Re: [Cfrg] SIV for non-AES ciphers first draft Tony Arcieri
Re: [Cfrg] SIV for non-AES ciphers first draft Paterson, Kenny
Re: [Cfrg] SIV for non-AES ciphers first draft Blumenthal, Uri - 0553 - MITLL