Re: [Crypto-panel] Review of AES-GCM-SIV

Thanks Scott. Once all the reviews are in, we'll collate them and post
them to the list.

On 19/06/2017 15:05, "Scott Fluhrer (sfluhrer)" <sfluhrer@cisco.com> wrote:

>My review:
>
>Summary: Almost Ready
>
>Major Concerns:
>
>None - from a security perspective, it looks pretty good
>
>
>Minor Concern:
>
>One thing that may be problematic to an implementor was the nonces listed
>in the test vectors.  AES-GCM-SIV takes 12 byte nonces, the nonces listed
>are 16 bytes long.  While this is unlikely to be a major source of
>confusion for an implementator, I suggest that the nonces be trimmed down
>before publishing.
>
>
>Nits:
>
>The encryption/decryption algorithms are given using fairly terse English
>descriptions.  While they are moderately clear to me, I wonder if they'd
>be as clear to someone else; I'm wondering if a pseudocode description
>would work better?  On the other hand, the test vectors give intermediate
>cipherstates (which would help a lot).
>
>While the test vectors are quite good in general, they use only one
>nonce, and two keys (one for each key length).  While there is certainly
>value in reusing the same key and nonce for slightly different
>plaintexts/AADs, I believe there would also be value in showing how
>different keys/nonces work.  One example: at one point,  AES-GCM-SIV
>xor's in the nonce into the POLYVAL result.  If someone did an incorrect
>implementation where (say) they exclusive-or'ed only the first 4 or 8
>bytes of the nonce, the current test vectors would still pass.
>
>The bytes in the test vector are listed LSB to MSB.  This rather assumes
>that the implementor is using little-endian byte ordering; I would
>suggest that this be changed to a more endian-neutral notation (possibly
>by just omitted the LSB and MSB labels).
>
>
>
>> -----Original Message-----
>> From: Crypto-panel [mailto:crypto-panel-bounces@irtf.org] On Behalf Of
>> Paterson, Kenny
>> Sent: Thursday, June 15, 2017 10:43 AM
>> To: Paterson, Kenny; crypto-panel@irtf.org
>> Cc: alexey.melnikov@isode.com
>> Subject: Re: [Crypto-panel] Review of AES-GCM-SIV
>> 
>> Sorry, that should be
>> https://tools.ietf.org/html/draft-irtf-cfrg-gcmsiv-05 (and not -04).
>> 
>> On 15/06/2017 15:38, "Paterson, Kenny" <Kenny.Paterson@rhul.ac.uk>
>> wrote:
>> 
>> >Dear CFRG panel members,
>> >
>> >Any volunteers from the panel to perform a review of:
>> >
>> >https://tools.ietf.org/html/draft-irtf-cfrg-gcmsiv-04
>> >
>> >
>> >I'd like to move it towards last call, and having a couple of reviews
>> >from you fine people would help give us the confidence to do so.
>> >
>> >The draft might be best read in conjunction with the technical paper:
>> >
>> >https://eprint.iacr.org/2017/168
>> >
>> >
>> >though of course it needs to stand alone as an RFC.
>> >
>> >Let me know.
>> >
>> >Cheers,
>> >
>> >Kenny
>> >
>> 
>> _______________________________________________
>> Crypto-panel mailing list
>> Crypto-panel@irtf.org
>> https://www.irtf.org/mailman/listinfo/crypto-panel