Re: [CFRG] Call for adoption for draft-denis-aegis-aead

> > From the draft:
> >
> > With AEGIS-256, random nonces can be used with no practical limits.
>
> We have use cases where we would like to encrypt >>>2^32 messages
> with random nonces. GCM limits us to 2^32 messages with random IVs,
> and it's not always possible to use deterministic IVs. Even when
> it _is_ possible to use deterministic IVs, we sometimes would like
> to encrypt >>2^64 messages with the same key. So having an AEAD scheme
> which supports a practically-unbounded number of messages per key would be useful.

As I said before, my main problem with AEGIS is that nonce misuse/reuse breaks it.

With that in mind, I think that AEGIS is better than AES-GCM, but worse than an "ideal" AEAD that I'd like to see standardized and widely deployed. 

Thanks

    -----Original Message-----
    From: Martin Thomson <mt@lowentropy.net> 
    Sent: Thursday, July 28, 2022 1:43 PM
    To: cfrg@irtf.org
    Subject: Re: [CFRG] Call for adoption for draft-denis-aegis-aead

    During the meeting I asked what justifies the definition of another AEAD.

    AEGIS looks cool, it's fast, it has a wide block, the key commitment, etc...  But it is still yet another AEAD and that comes with costs.  Not just for this group in terms of documenting and reviewing the work, but for implementations and for interoperation.  In environments where there is no pre-existing AEAD usage, this might be justified, but for those scenarios I work on, AES-GCM or ChaCha20Poly1305 are still vastly superior, simply by virtue of them being widely deployed.

    Are there cases that might use AEGIS but cannot use these other AEADs?

    On Fri, Jul 8, 2022, at 01:27, Stanislav V. Smyshlyaev wrote:
    > Dear CFRG participants,
    >
    > This email commences a 2-week call for adoption for "The AEGIS family 
    > of authenticated encryption algorithms" draft
    > (draft-denis-aegis-aead-05) that will end on July 22nd 2022:
    > https://datatracker.ietf.org/doc/draft-denis-aegis-aead/
    >
    > The document was introduced at the IETF 113 CFRG meeting, see
    > https://datatracker.ietf.org/meeting/113/materials/slides-113-cfrg-aeg
    > is-fast-authenticated-encryption-family-00
    >
    > Please give your views on whether this document should be adopted as a 
    > CFRG draft, and if so, whether you'd be willing to help work on 
    > it/review it.
    >
    > Please reply to this email (or in exceptional circumstances you can 
    > email CFRG chairs directly at cfrg-chairs@ietf.org).
    >
    > Thank you,
    > Stanislav (for the chairs)
    > _______________________________________________
    > CFRG mailing list
    > CFRG@irtf.org
    > https://www.irtf.org/mailman/listinfo/cfrg

    _______________________________________________
    CFRG mailing list
    CFRG@irtf.org
    https://www.irtf.org/mailman/listinfo/cfrg

Re: [CFRG] Call for adoption for draft-denis-aegis-aead

Attachment: smime.p7s