Re: [Cfrg] Kravatte-SANSE

Russ Housley <housley@vigilsec.com> Sun, 04 November 2018 00:57 UTC

Return-Path: <housley@vigilsec.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F79F127333 for <cfrg@ietfa.amsl.com>; Sat, 3 Nov 2018 17:57:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Level:
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hollp1zzpIZ6 for <cfrg@ietfa.amsl.com>; Sat, 3 Nov 2018 17:57:56 -0700 (PDT)
Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF085126BED for <cfrg@irtf.org>; Sat, 3 Nov 2018 17:57:56 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 173A9300AB2 for <cfrg@irtf.org>; Sat, 3 Nov 2018 20:57:54 -0400 (EDT)
X-Virus-Scanned: amavisd-new at mail.smeinc.net
Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id o8vMDIsLYh7W for <cfrg@irtf.org>; Sat, 3 Nov 2018 20:57:51 -0400 (EDT)
Received: from dhcp-9bbe.meeting.ietf.org (dhcp-9bbe.meeting.ietf.org [31.133.155.190]) by mail.smeinc.net (Postfix) with ESMTPSA id A3BB6300A48; Sat, 3 Nov 2018 20:57:50 -0400 (EDT)
From: Russ Housley <housley@vigilsec.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_DC271F35-72BB-4DC0-B7E3-40EE682CF04D"
Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\))
Date: Sat, 03 Nov 2018 20:57:47 -0400
References: <42866222-0a32-28df-665c-ad916e69c2a3@st.com>
Cc: IRTF CFRG <cfrg@irtf.org>
To: gilles.vanassche@st.com
Message-Id: <78385742-DE3F-40F3-9D2D-9A7F78B9FD21@vigilsec.com>
X-Mailer: Apple Mail (2.3445.9.1)
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/zGtTOE-9uLOxQxsFL5JkDMJoJOw>
Subject: Re: [Cfrg] Kravatte-SANSE
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Sun, 04 Nov 2018 00:58:00 -0000

Gilles:

I am interesting in the property that "each tag authenticates all messages already sent so far in the session".  I have not had an opportunity to review the references provided.  Does this mechanism work even if some of the messages are not delivered?

Russ


> From: Gilles Van Assche <gilles.vanassche@st.com>
> Subject: [Cfrg] Kravatte-SANSE
> Date: November 2, 2018 at 8:52:21 AM EDT
> To: <cfrg@irtf.org>
> 
> (sorry, with the correct subject this time…)
> 
> Dear all,
> 
> On a related note, we published at ToSC last year (and presented at FSE
> 2018) the Kravatte pseudo-random function [1], to which an SIV mode can
> be attached. More specifically, we recently specified the SIV-based
> authenticated encryption scheme Kravatte-SANSE [2]. As a feature, it
> also supports sessions, for use cases where multiple messages are
> exchanged and where each tag authenticates all messages already sent so
> far in the session.
> 
> This function is based on the 6-round Keccak-p permutation and performs
> well in software without AES hardware acceleration. For instance,
> Kravatte-SANSE processes plaintext and metadata at 1.32 cycles/byte on
> Skylake and at 0.84 c/b on SkylakeX processors.
> 
> Would this be of interest to CFRG?
> 
> Kind regards,
> Guido, Joan, Seth, Michaël, Gilles and Ronny
> 
> [1] https://tosc.iacr.org/index.php/ToSC/article/view/855
> [2] https://keccak.team/2018/kravatte_sane_sanse.html
> 
> 
> On 4/10/18 12:12, Neil Madden wrote:
>> Hi,
>> 
>> I am interested in adapting the SIV construction to other ciphers and MAC algorithms. As currently specified in RFC 5297, the mode is only defined for a MAC (AES-CMAC) that produces a 128-bit tag length. Furthermore, it assumes that the tag length is exactly the same as the nonce/IV required by the cipher (i.e., also 128-bits for AES-CTR). This restriction to limit the authentication strength of the AEAD based on the length of the required nonce for confidentiality seems somewhat artificial to me.
>> 
>> As a concrete example, I am interested in SIV constructions based on XSalsa20 (or XChaCha20 as recently proposed on this list) together with some keyed hash MAC, such as HMAC-SHA256 or Blake2. XSalsa20 requires a nonce of 192-bits, while HMAC-SHA256 produces a MAC tag of 256 bits. I have a draft recommending MRAE modes for JOSE, and would like to include one non-AES algorithm that can be implemented well in software on platforms without AES hardware acceleration.
>> 
>> I believe that there are just two adaptions needed to make this work:
>> 
>> 1. Adjusting the conditional XOR constant used in the doubling operation in s2v (https://tools.ietf.org/html/rfc5297#section-2.3) to account for other field sizes.
>> 2. Defining the nonce used as input to the cipher as the left-most n bits of the authentication tag returned from s2v, where n is the size of the nonce required by the cipher (i.e., the full tag is output, but a truncation of it is used as the nonce).
>> 
>> For step 1, based on the comments in [1] and the table of primitive polynomials from [2], I think the polynomials and corresponding constants to use for different values of n (bit length of MAC output) are:
>> 
>> n = 128 gives x^128 + x^7 + x^2 + x + 1 and constant = 0^{120}10000111 (= 0x87 with leading 0s)
>> n = 192 gives x^192 + x^7 + x^2 + x + 1 and constant = 0^{184}10000111 (= 0x87 with more leading 0s)
>> n = 256 gives x^256 + x^10 + x^5 + x^2 + 1 and constant = 0^{245}10000100101 (= 0x00..0425)
>> 
>> Is this something that CFRG might support if I submitted a draft?
>> 
>> Regards,
>> 
>> Neil
>> 
>> [1]: http://web.cs.ucdavis.edu/~rogaway/papers/siv.pdf
>> [2]: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.365.1806&rep=rep1&type=pdf
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> https://www.irtf.org/mailman/listinfo/cfrg
>> 
> 
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg