Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document

On Wed, March 30, 2016 9:13 pm, Yoav Nir wrote:
> Hi, Tony
>
>> On 31 Mar 2016, at 6:40 AM, Tony Arcieri <bascule@gmail.com> wrote:
>>
>> On Wed, Mar 30, 2016 at 6:56 PM, denis bider <ietf-cfrg@denisbider.com
>> <mailto:ietf-cfrg@denisbider.com>> wrote:
>> I believe Dan's point was that AES256-GCM-SIV uses a 128-bit tag to
>> derive the final encryption key.
>>
>> No?
>> 4.  Encryption
>>
>>    AES-GCM-SIV encryption takes a 16-byte authentication key, a 16- or
>>    32-byte AES key, a 128-bit nonce, and arbitrary-length plaintext and
>>    additional data inputs.  It outputs an authenticated ciphertext that
>>    will be 16 bytes longer than the plaintext.
>
> I think the relevant section is the next paragraph where the record
> encryption key is defined. That too is defined to be the same length as
> the input key:
>
>    If the AES key is 16 bytes long then define the _record-encryption
>    key_ as the encryption of the nonce using the AES key.  If AES-256 is
>    being used then this is insufficient as 256 bits of key material are
>    needed.  Therefore the record-encryption key in this case is the
>    concatenation of the result of encrypting, using the AES key, the
>    nonce with the least-significant bit of the first byte set to zero
>    and then to one.

  It's not the length, it's the number of values possible in that
length. Because this cipher mode is using AES-256-ECB as a 128-bit
PRP it is generating two distinct 128-bit blobs and concatenating
them. That means that there can only be 2^128 possible values of
that 256-bit key.

  So I guess it's still using AES-256-CTR to encrypt the data but
the 256-bit key used in that invocation can only take 2^128 possible
values. And that, to me, seems like a shortcoming especially when
you consider that the authentication key is always 128-bits
regardless of the length of the encryption key.

  If some 256-bit cipher mode specified that the high-order 128-bits
of the key MUST be set to zero would you say the cipher was any
better than a 128-bit equivalent that used all 128-bits?

  regards,

  Dan.

> Yoav_______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>