Re: [Crypto-panel] Review of AES-GCM-SIV

My review:

Summary: Almost Ready

Major Concerns:

None - from a security perspective, it looks pretty good

Minor Concern:

One thing that may be problematic to an implementor was the nonces listed in the test vectors.  AES-GCM-SIV takes 12 byte nonces, the nonces listed are 16 bytes long.  While this is unlikely to be a major source of confusion for an implementator, I suggest that the nonces be trimmed down before publishing.

Nits:

The encryption/decryption algorithms are given using fairly terse English descriptions.  While they are moderately clear to me, I wonder if they'd be as clear to someone else; I'm wondering if a pseudocode description would work better?  On the other hand, the test vectors give intermediate cipherstates (which would help a lot).

While the test vectors are quite good in general, they use only one nonce, and two keys (one for each key length).  While there is certainly value in reusing the same key and nonce for slightly different plaintexts/AADs, I believe there would also be value in showing how different keys/nonces work.  One example: at one point,  AES-GCM-SIV xor's in the nonce into the POLYVAL result.  If someone did an incorrect implementation where (say) they exclusive-or'ed only the first 4 or 8 bytes of the nonce, the current test vectors would still pass.

The bytes in the test vector are listed LSB to MSB.  This rather assumes that the implementor is using little-endian byte ordering; I would suggest that this be changed to a more endian-neutral notation (possibly by just omitted the LSB and MSB labels).

> -----Original Message-----
> From: Crypto-panel [mailto:crypto-panel-bounces@irtf.org] On Behalf Of
> Paterson, Kenny
> Sent: Thursday, June 15, 2017 10:43 AM
> To: Paterson, Kenny; crypto-panel@irtf.org
> Cc: alexey.melnikov@isode.com
> Subject: Re: [Crypto-panel] Review of AES-GCM-SIV
> 
> Sorry, that should be
> https://tools.ietf.org/html/draft-irtf-cfrg-gcmsiv-05 (and not -04).
> 
> On 15/06/2017 15:38, "Paterson, Kenny" <Kenny.Paterson@rhul.ac.uk>
> wrote:
> 
> >Dear CFRG panel members,
> >
> >Any volunteers from the panel to perform a review of:
> >
> >https://tools.ietf.org/html/draft-irtf-cfrg-gcmsiv-04
> >
> >
> >I'd like to move it towards last call, and having a couple of reviews
> >from you fine people would help give us the confidence to do so.
> >
> >The draft might be best read in conjunction with the technical paper:
> >
> >https://eprint.iacr.org/2017/168
> >
> >
> >though of course it needs to stand alone as an RFC.
> >
> >Let me know.
> >
> >Cheers,
> >
> >Kenny
> >
> 
> _______________________________________________
> Crypto-panel mailing list
> Crypto-panel@irtf.org
> https://www.irtf.org/mailman/listinfo/crypto-panel