Re: Hardware acceleration and packet number encryption

[Christian Huitema <[e-mail]>]

On 3/24/2018 9:25 AM, Eric Rescorla wrote:
> I think it would probably be useful to ask this question in two pieces.
>
> ...
> Finally, we could use a more exotic solution like AERO. The draft has
> details, but roughly speaking, it's like an extension of AEAD which
> also takes the sequence number as an input on encryption and then
> returns it on decryption, so you don't need a separate sequence number
> or nonce. Obviously this is pretty much designed for our purpose, but
> it's a relatively new construction and so I don't know how much
> analysis there has been of its security. In addition, while it's based
> on AES-CTR, I don't know what the performance is like in hardware.

I am not so sure about that. The AERO construct relies on a "Wide
Pseudo-Random Permutation" (WPRP). To quote from the AERO draft, "A WPRP
has the property that each bit of its output is a pseudorandom function
of each bit of both of its inputs, for both encryption and decryption."
With that property, the sequence number can be appended to the plain
text; all bits of output will depend on it, in the same way that all
bits of the AEAD input depend on the nonce. But, to quote from the draft
again, "A WPRP is necessarily an offline algorithm", and "offline
algorithms cannot be implemented in a hardware pipeline, such as those
used in high-speed network encryption (for protocols such as 802.1AE)."

The AERO draft goes on explaining that the WPRP requirement might be
relaxed with a different construct,  "Online Pseudo-Random Permutation"
(OPRP), in which "the ith block of output depends only on the first i
blocks of input, for all values of i." But that construct is not
actually developed in the draft.

-- Christian Huitema

but that alternative construct is not fully explained.

-- Christian Huitema