Re: [CFRG] Call for adoption for draft-denis-aegis-aead

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

When I said "ideal", I was exaggerating (of course) - as long as it's practical and performant, it's "good enough".

One advantage of AES-based ciphers and modes is that they can benefit from Intel and ARM hardware AES acceleration. How does ChaCha compare against hardware-accelerated AES? This would be my main concern here.

Other than that - Daence sounds like a good candidate. And I don't remember exactly - there was Romulus (or such) that NIST LWC awarded...?

Thanks
--
V/R,
Uri
 
There are two ways to design a system. One is to make it so simple there are obviously no deficiencies.
The other is to make it so complex there are no obvious deficiencies.
                                                                                                                                     -  C. A. R. Hoare
 

On 7/28/22, 15:48, "Taylor R Campbell" <[e-mail] on behalf of [e-mail]> wrote:

    > Date: Thu, 28 Jul 2022 19:15:23 +0000
    > From: "Blumenthal, Uri - 0553 - MITLL" <[e-mail]>
    > 
    > > > From the draft:
    > > >
    > > > With AEGIS-256, random nonces can be used with no practical limits.
    > >
    > > We have use cases where we would like to encrypt >>>2^32 messages
    > > with random nonces. GCM limits us to 2^32 messages with random IVs,
    > > and it's not always possible to use deterministic IVs. Even when
    > > it _is_ possible to use deterministic IVs, we sometimes would like
    > > to encrypt >>2^64 messages with the same key. So having an AEAD scheme
    > > which supports a practically-unbounded number of messages per key would be useful.
    > 
    > As I said before, my main problem with AEGIS is that nonce
    > misuse/reuse breaks it.
    > 
    > With that in mind, I think that AEGIS is better than AES-GCM, but
    > worse than an "ideal" AEAD that I'd like to see standardized and
    > widely deployed.

    Won't claim it's ideal, but ChaCha-Daence:

    (a) supports a practically-unbounded number of messages per key[1];
    (b) falls back to deterministic authenticated encryption security like
        AES-SIV if you don't have unique per-message numbers or if your
        RNG/counter goes wrong;
    (c) can take advantage of public or secret message numbers, whether
        deterministic or random;
    (d) does not require a randomized nonce like AES-GCM-SIV does for
        nonce-misuse-resistance;
    (e) has a simpler interface, DAE (key,ad,message), than nonce-based
        AEAD (key,nonce,ad,message); and
    (f) is built out of the same components as ChaCha/Poly1305 so it only
        takes a few lines of code with those components to implement it,
        so it's cheap to drop into applications that already use libraries
        with ChaCha and Poly1305 today -- no assembly (code) required.

    Details and security theorem: https://eprint.iacr.org/2020/067

    [1] Table of advantage bounds on p. 5 of the manuscript is generated
        by https://github.com/riastradh/daence/blob/master/adv.py, with
        references there to the best advantage bounds in the literature on
        AES-GCM, AES-GCM-SIV, AES-SIV, and ChaCha/Poly1305 security.