Re: [CFRG] HPKE and Key Wrapping

[John Mattsson <[e-mail]>]

Thanks Taylor!

Then it seems to me that AES-256-SIV and AES-512-SIV are the AES-based modes that should be added to HPKE to enable key wrapping security independent of the RNG. These are exactly the two AEADs suggested by draft-harkins-cfrg-dnhpke-01. Key wrapping mechanisms have in the past aimed to provide security even in the case of compromised RNG but it would be interesting to hear if someone think that property is needed in this case.

Cheers,
John

From: Taylor R Campbell <[e-mail]> on behalf of Taylor R Campbell <[e-mail]>
Date: Wednesday, 30 March 2022 at 12:29
To: John Mattsson <[e-mail]>
Cc: Dan Harkins <[e-mail]>, IRTF CFRG <[e-mail]>
Subject: Re: [CFRG] HPKE and Key Wrapping
> Date: Wed, 30 Mar 2022 08:51:44 +0000
> From: John Mattsson <john.mattsson=[e-mail]>
>
> How does AES-SIV (RFC 5297) compare with AES-GCM-SIV (RFC 8452)? Do
> we need both algorithms in the future? Does AES-GCM-SIV with a fixed
> nonce provide the same properties as nonce-less AES-SIV or is there
> a difference?

There is a fairly substantial difference.  In the Daence paper I drew
a table of advantage bounds for AES-SIV and AES-GCM-SIV, using the
best formulae I could find (with the function/permutation-switching
lemma of https://protect2.fireeye.com/v1/url?k=31323334-501d5122-313273af-454445555731-a129ecc550c2c3ad&q=1&e=117ce771-01cf-4d9c-aa89-a8b4b42eab86&u=https%3A%2F%2Fcr.yp.to%2Fpapers.html%23permutations that gives better
bounds than the conventional q*(q - 1)/2 used in most papers):

https://protect2.fireeye.com/v1/url?k=31323334-501d5122-313273af-454445555731-fc96309953b1fcfb&q=1&e=117ce771-01cf-4d9c-aa89-a8b4b42eab86&u=https%3A%2F%2Feprint.iacr.org%2F2020%2F067.pdf%23page%3D5

Smaller advantage bounds, i.e., larger values of n in the 2^-n terms,
are better.  1 means no advantage bound has been proven at all for
these parameters.

This table was computed using the logic at

https://protect2.fireeye.com/v1/url?k=31323334-501d5122-313273af-454445555731-ab6fc8eec24511fa&q=1&e=117ce771-01cf-4d9c-aa89-a8b4b42eab86&u=https%3A%2F%2Fgithub.com%2Friastradh%2Fdaence%2Fblob%2Fmaster%2Fadv.py

which cites the sources in the literature I used for the formulae.
You can reuse the same logic to recompute bounds for different message
sizes/numbers if what you're looking for isn't in the table, of
course.

It may be worth noting that the security advertisment in RFC 8452 for
AES-GCM-SIV explicitly discourages nonce reuse even between different
users (different keys), which means you should even avoid the policy
of sequential message numbers that, e.g., TLS 1.3 uses with AES-GCM to
rule out a class of attacks:

https://datatracker.ietf.org/doc/html/rfc8452#page-12

The bottom line is that AES-GCM-SIV is designed for randomized nonces,
with some level of protection if your RNG fails.  In contrast, AES-SIV
is designed for security without nonces at all, and is particularly
well-suited to key-wrap, which should come as no surprise since that's
what it was designed for originally, as sung in Appendix F of:

https://web.cs.ucdavis.edu/~rogaway/papers/keywrap.html