[CFRG] Re: Comments on draft-irtf-cfrg-aead-properties-09.txt

["MINEMATSU KAZUHIKO(峯松 一彦)" <[e-mail]>]

Dear Andrey, 

Thanks a lot for your detailed reply and encouraging words! 
We surely understand the constraints and agree with your approach to incorporating our comments. 
Also thanks for letting us know the github plan. We will keep eyes on that. Let us keep in touch. 

Best regards,
Kazu on behalf of the authors

> -----Original Message-----
> From: Andrey Bozhko <[e-mail]>
> Sent: Tuesday, February 4, 2025 9:44 PM
> To: MINEMATSU KAZUHIKO(峯松　一彦) <[e-mail]>
> Cc: [e-mail]; INOUE AKIKO(井上　明子) <[e-mail]>; IWATA Tetsu
> <[e-mail]>
> Subject: Re: [CFRG] Comments on draft-irtf-cfrg-aead-properties-09.txt
> 
> Dear Akiko, Tetsu, and Kazuhiko,
> 
> Thank you very much for your comments and for sharing your paper—it's an exciting
> and highly interesting work.
> 
> Unfortunately, adding (or subdividing) properties won’t be possible at this stage, as
> the list of properties was finalized some time ago, prior to the technical reviews.
> However, I believe adding clarifications on examples based on your paper and, in
> particular, correcting the mention of OCB in the Inverse-Free section (many thanks
> for catching that!) should be possible during the editorial stage when it’s the draft’s
> turn in the queue.
> 
> Additionally, once the draft is published, I plan to maintain a somewhat extended
> (and experimental) version on GitHub
> (https://github.com/AndAlBo/draft-irtf-cfrg-aead-properties) since the field is still
> actively evolving. I intend to incorporate your comments there in more detail as well.
> Please feel free to propose any further changes or improvements there.
> 
> Once again, thank you for your valuable comments!
> 
> Best,
> Andrey
> 
> 
> On Tue, Feb 4, 2025 at 09:08 MINEMATSU KAZUHIKO(峯松　一彦)
> <k-minematsu=[e-mail] <mailto:[e-mail]>
> > wrote:
> 
> 
> 	Dear all,
> 
> 	We recently learned about the I-D on AEAD
> 	(draft-irtf-cfrg-aead-properties-09) and found it quite relevant in
> 	practice.
> 	As we published a paper on robustness of common AEs ([IIM25], will appear
> at
> 	CT-RSA 2025), we would like to share our comments on the draft.
> 
> 	In [IIM25], Table 1 provides a comprehensive view on nonce-misuse or RUP
> 	security of GCM/CCM/OCB(3), which would be helpful to improve Sections
> 4.3.7
> 	and 4.3.10 of the draft. Concretely:
> 	1. Sect 4.3.7, Nonce-misuse resilience confidentiality (NML-Priv in our
> 	paper): it holds for GCM but only with 96-bit nonce. This was shown by
> 	[ADL17]. Our paper shows that CCM has NML-Priv.
> 	2. Sect 4.3.7, Nonce-misuse resistance (NMR in our paper): NMR could be
> 	further classified into confidentiality (privacy) and authenticity as the
> 	draft did for NML. Then we have two notions, Nonce-misuse resistance
> 	confidentiality/privacy (NMR-Priv) and Nonce-misuse resistance
> 	authenticity/integrity (NMR-Auth). [IIM25] shows that CCM has NMR-Auth
> (even
> 	stronger. See below).
> 	3.  Sect 4.3.10: INT-RUP could be classified into the cases where nonce
> may
> 	be repeated or not. We can also consider combined notions such as NMR +
> 	INT-RUP.
> 	[IIM25] shows that
> 	- GCM has plain INT-RUP (i.e. nonce does not repeat in encryption queries)
> 	- CCM has NMR-INT-RUP (i.e. nonce may repeat at any query).
> 
> 	As a side note, at Sect 4.4.2 (Inverse-Free), OCB was listed as an example,
> 	which is not correct. If you mean an inverse-free OCB-like parallel AE mode,
> 	OTR [Min14] would be the right one here.
> 	Moreover, COFB [CIMN17], the base scheme of a NIST LwC finalist
> GIFT-COFB,
> 	is an inverse-free serial AE mode enabling smaller state than OCB/OTR.
> 
> 	We hope these comments will help improving the draft.
> 
> 	Best regards,
> 	Akiko Inoue
> 	Tetsu Iwata
> 	Kazuhiko Minematsu
> 
> 
> 	[IIM25] Comprehensive Robustness Analysis of GCM, CCM, and OCB3,
> Akiko
> 	Inoue, Tetsu Iwata and Kazuhiko Minematsu
> 	https://eprint.iacr.org/2024/1339 (to appear at CT-RSA 2025)
> 
> 	[Min14] Parallelizable Rate-1 Authenticated Encryption from Pseudorandom
> 	Functions, Kazuhiko Minematsu. EC 2014
> 	https://eprint.iacr.org/2013/628
> 
> 	[CIMN17] Blockcipher-based Authenticated Encryption: How Small Can We
> Go?,
> 	Avik Chakraborti, Tetsu Iwata, Kazuhiko Minematsu, and Mridul Nandi,
> CHES
> 	2017.
> 	https://eprint.iacr.org/2017/649
> 	_______________________________________________
> 	CFRG mailing list -- [e-mail] <mailto:[e-mail]>
> 	To unsubscribe send an email to [e-mail]
> <mailto:[e-mail]>
>