Re: [Cfrg] Halon's Razor -> Re: NSA sabotaging crypto standards

[Paul Lambert <[e-mail]>]

Tom,

Thank you for your shameless plug... it's very interesting work.  Also, my apologies on  my imprecise statement about SIV.  SIV is very interesting because it is NOT the conventional conservative model - it's clearly not encrypt-then-MAC.   It is an excellent example of out-of-the-conventional-box thinking that would be eliminated if we create arbitrary guidelines for algorithm structure.  

Do send a pointer to the list when it's posted.

Regards,

Paul

]-----Original Message-----
]From: Tom Shrimpton [mailto:[e-mail]]
]Sent: Friday, February 07, 2014 12:24 PM
]To: Paul Lambert
]Cc: [e-mail]; Watson Ladd; Nikos Mavrogiannopoulos
]Subject: Re: [Cfrg] Halon's Razor -> Re: NSA sabotaging crypto standards
]
]
]
]On Fri Feb 7 11:54:30 2014, Paul Lambert wrote:
]>> Show me one cryptographer who recommended MAC-then-Encrypt.
]>> Also, absence of known attacks is not the same as absence of attacks.
]>> Encrypt-then-MAC was the conservative choice.
]>
]> SIV is MAC then encrypt Š in it¹s own unusual manner.
]As one of the designers of SIV, I have to object to saying that SIV is
]MAC-then-encrypt, even if you soften the claim with "in it's own unusual
]manner."  SIV doesn't fit into any of the traditional generic
]composition categories -- MAC-then-encrypt, encrypt-then-MAC, encrypt-
]and-MAC -- for a number of reasons.
]
]For one thing, treating the PRF output as the IV (and the transmitted
]tag!) is quite different that treating it as part of the plaintext to be
]encrypted.
]
]For another, SIV mode neither starts with, nor yields the kind of
]cryptographic object that the Bellare-Namprempre results address.
](I'm pointing to the (excellent) [BN] paper because it has significantly
]shaped the way our community thinks about building AE schemes via MtE,
]EtM and
]E&M.)
][BN] is about producing *probabilistic* AE schemes from *probabilistic*
]encryption, and a MAC.  But SIV is a *deterministic*, nonce-based AE
]scheme, built from an underlying *deterministic*, IV-based encryption
]scheme, and a PRF.
]
]This is something that Phil Rogaway, Chanathip Namprempre and I have
]been thinking about a lot lately -- what is the GC story when one starts
]from nonce-based or IV-based encryption, and a PRF, and wants to produce
]a nonce-based AEAD scheme?
]At Eurocrypt 2014, we'll present a paper that explores this question in
]detail.
](You can expect the full version to appear on the IACR eprint server in
]the next week or so.)
]
]Sorry if that seemed like a shameless plug, but it did seem appropriate
]to mention the upcoming paper as part of this response.
]
]Cheers,
]-Tom Shrimpton