Re: [Crypto-panel] Review of AES-GCM-SIV

[Tibor Jager <[e-mail]>]

Hi all,

On 01/07/2017 20:34, Bjoern Tackmann wrote:
> Please find my review below. It's a nice piece of work and overall in
> quite good shape.
> 
> After looking at the other reviews: I do not quite understand Tibor's
> comment on the bit-length vs. byte-length, given that the draft states
> that the scheme takes "arbitrary-length plaintext & additional data
> byte-strings" -- and for me the term "byte-strings" means that the
> byte-length of the strings is an integer.

Indeed, this is one of the sections that suggests that it is implicitly
assumed that "valid" plaintexts and AD have always a byte-length which
is an integer.

What I found *potentially* confusing is:

- Then it would also be somewhat more intuitive/consistent to include
the byte-length of plaintext and AD in the length block. The current
draft includes the bit-length. (This is of course technically fine and
essentially just a different notation, but *could* be confusing.)

- Also the example in Section 8 mentions the bit-length.

- It would also make sense to let the encryption algorithm abort, if the
lengths of plaintexts and AD are not a multiple of 8 bits (and one could
ignore this check in applications where this is guaranteed by the
environment - but this is of course something that only the application
developer can decide).

I do not see this as a big issue either, I just wanted to suggest to
mention this assumption about the plaintext length more clearly - even
if it seems quite standard to assume plaintexts/ADs are always given as
sequences of bytes, and will most likely hold for most application anyway.

Cheers,
Tibor