Re: [Cfrg] Kravatte-SANSE
Russ Housley <housley@vigilsec.com> Sun, 04 November 2018 00:57 UTC
Return-Path: <housley@vigilsec.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F79F127333 for <cfrg@ietfa.amsl.com>; Sat, 3 Nov 2018 17:57:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Level:
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hollp1zzpIZ6 for <cfrg@ietfa.amsl.com>; Sat, 3 Nov 2018 17:57:56 -0700 (PDT)
Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF085126BED for <cfrg@irtf.org>; Sat, 3 Nov 2018 17:57:56 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 173A9300AB2 for <cfrg@irtf.org>; Sat, 3 Nov 2018 20:57:54 -0400 (EDT)
X-Virus-Scanned: amavisd-new at mail.smeinc.net
Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id o8vMDIsLYh7W for <cfrg@irtf.org>; Sat, 3 Nov 2018 20:57:51 -0400 (EDT)
Received: from dhcp-9bbe.meeting.ietf.org (dhcp-9bbe.meeting.ietf.org [31.133.155.190]) by mail.smeinc.net (Postfix) with ESMTPSA id A3BB6300A48; Sat, 3 Nov 2018 20:57:50 -0400 (EDT)
From: Russ Housley <housley@vigilsec.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_DC271F35-72BB-4DC0-B7E3-40EE682CF04D"
Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\))
Date: Sat, 03 Nov 2018 20:57:47 -0400
References: <42866222-0a32-28df-665c-ad916e69c2a3@st.com>
Cc: IRTF CFRG <cfrg@irtf.org>
To: gilles.vanassche@st.com
Message-Id: <78385742-DE3F-40F3-9D2D-9A7F78B9FD21@vigilsec.com>
X-Mailer: Apple Mail (2.3445.9.1)
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/zGtTOE-9uLOxQxsFL5JkDMJoJOw>
Subject: Re: [Cfrg] Kravatte-SANSE
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Sun, 04 Nov 2018 00:58:00 -0000
Gilles: I am interesting in the property that "each tag authenticates all messages already sent so far in the session". I have not had an opportunity to review the references provided. Does this mechanism work even if some of the messages are not delivered? Russ > From: Gilles Van Assche <gilles.vanassche@st.com> > Subject: [Cfrg] Kravatte-SANSE > Date: November 2, 2018 at 8:52:21 AM EDT > To: <cfrg@irtf.org> > > (sorry, with the correct subject this time…) > > Dear all, > > On a related note, we published at ToSC last year (and presented at FSE > 2018) the Kravatte pseudo-random function [1], to which an SIV mode can > be attached. More specifically, we recently specified the SIV-based > authenticated encryption scheme Kravatte-SANSE [2]. As a feature, it > also supports sessions, for use cases where multiple messages are > exchanged and where each tag authenticates all messages already sent so > far in the session. > > This function is based on the 6-round Keccak-p permutation and performs > well in software without AES hardware acceleration. For instance, > Kravatte-SANSE processes plaintext and metadata at 1.32 cycles/byte on > Skylake and at 0.84 c/b on SkylakeX processors. > > Would this be of interest to CFRG? > > Kind regards, > Guido, Joan, Seth, Michaël, Gilles and Ronny > > [1] https://tosc.iacr.org/index.php/ToSC/article/view/855 > [2] https://keccak.team/2018/kravatte_sane_sanse.html > > > On 4/10/18 12:12, Neil Madden wrote: >> Hi, >> >> I am interested in adapting the SIV construction to other ciphers and MAC algorithms. As currently specified in RFC 5297, the mode is only defined for a MAC (AES-CMAC) that produces a 128-bit tag length. Furthermore, it assumes that the tag length is exactly the same as the nonce/IV required by the cipher (i.e., also 128-bits for AES-CTR). This restriction to limit the authentication strength of the AEAD based on the length of the required nonce for confidentiality seems somewhat artificial to me. >> >> As a concrete example, I am interested in SIV constructions based on XSalsa20 (or XChaCha20 as recently proposed on this list) together with some keyed hash MAC, such as HMAC-SHA256 or Blake2. XSalsa20 requires a nonce of 192-bits, while HMAC-SHA256 produces a MAC tag of 256 bits. I have a draft recommending MRAE modes for JOSE, and would like to include one non-AES algorithm that can be implemented well in software on platforms without AES hardware acceleration. >> >> I believe that there are just two adaptions needed to make this work: >> >> 1. Adjusting the conditional XOR constant used in the doubling operation in s2v (https://tools.ietf.org/html/rfc5297#section-2.3) to account for other field sizes. >> 2. Defining the nonce used as input to the cipher as the left-most n bits of the authentication tag returned from s2v, where n is the size of the nonce required by the cipher (i.e., the full tag is output, but a truncation of it is used as the nonce). >> >> For step 1, based on the comments in [1] and the table of primitive polynomials from [2], I think the polynomials and corresponding constants to use for different values of n (bit length of MAC output) are: >> >> n = 128 gives x^128 + x^7 + x^2 + x + 1 and constant = 0^{120}10000111 (= 0x87 with leading 0s) >> n = 192 gives x^192 + x^7 + x^2 + x + 1 and constant = 0^{184}10000111 (= 0x87 with more leading 0s) >> n = 256 gives x^256 + x^10 + x^5 + x^2 + 1 and constant = 0^{245}10000100101 (= 0x00..0425) >> >> Is this something that CFRG might support if I submitted a draft? >> >> Regards, >> >> Neil >> >> [1]: http://web.cs.ucdavis.edu/~rogaway/papers/siv.pdf >> [2]: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.365.1806&rep=rep1&type=pdf >> _______________________________________________ >> Cfrg mailing list >> Cfrg@irtf.org >> https://www.irtf.org/mailman/listinfo/cfrg >> > > _______________________________________________ > Cfrg mailing list > Cfrg@irtf.org > https://www.irtf.org/mailman/listinfo/cfrg
- [Cfrg] Extending SIV to other ciphers and MAC alg… Neil Madden
- Re: [Cfrg] Extending SIV to other ciphers and MAC… John Mattsson
- Re: [Cfrg] Extending SIV to other ciphers and MAC… Paterson, Kenny
- Re: [Cfrg] Extending SIV to other ciphers and MAC… Alexandre Anzala-Yamajako
- Re: [Cfrg] Extending SIV to other ciphers and MAC… Tony Arcieri
- Re: [Cfrg] Extending SIV to other ciphers and MAC… Neil Madden
- Re: [Cfrg] Extending SIV to other ciphers and MAC… Neil Madden
- Re: [Cfrg] Extending SIV to other ciphers and MAC… Neil Madden
- Re: [Cfrg] Extending SIV to other ciphers and MAC… John Mattsson
- [Cfrg] Farfalle-SANSE Gilles Van Assche
- [Cfrg] Kravatte-SANSE Gilles Van Assche
- Re: [Cfrg] Kravatte-SANSE Russ Housley
- Re: [Cfrg] Kravatte-SANSE Gilles Van Assche
- Re: [Cfrg] Farfalle-SANSE Nick Sullivan
- Re: [Cfrg] Kravatte-SANSE Gilles Van Assche