Re: [Cfrg] AES-GCM-SIV security of the additional data

[Adam Langley <[e-mail]>]

On Fri, Jun 24, 2016 at 6:24 AM, Paterson, Kenny
<[e-mail]> wrote:
> On a related point, my view is that it is a disbenefit that the
> AES-GCM-SIV proposal has two separate keys (one for encryption, the other
> for authentication) as inputs. That's not the AEAD interface that we have
> raised our implementers on. I raised this point at the CFRG meeting in
> Vienna back in May. Simply concatenating the two keys in the current
> proposal into one would address this issue, but not the one you raise (if
> I understand it correctly).

The two keys are already concatenated in the draft, or else I
misunderstood your point:
https://tools.ietf.org/html/draft-irtf-cfrg-gcmsiv-01#section-6

"Since the definition of an AEAD requires that the key be a single
value we define AEAD_AES_128_GCM_SIV to take a 32-byte key: the first
16 bytes of which are used as the authentication key and the remaining
16 bytes are used as the AES key. Likewise AEAD_AES_256_GCM_SIV takes
an 48-byte key: the first 16 bytes are again the authentication key
and the remaining 32 bytes is the AES key."


Cheers

AGL

-- 
Adam Langley [e-mail] https://www.imperialviolet.org