Re: [Sframe] "AES-GCM" with secure short tags

Hi John,

Thanks for taking a look at this.  I expect something truncatable would be
of interest for a variety of media-encryption things (SRTP, SFrame, MoQ, et
al.).  Audio packets are small, numerous, and ephemeral, so on the one
hand, they are very sensitive in percentage terms to crypto overhead, and
on the other hand, you don't care a ton about forgery of any individual
packet.

That said, support in practice might be limited until this GCM change was
available in crypto libraries.

--Richard

On Mon, Mar 27, 2023 at 4:57 AM John Mattsson <john.mattsson=
40ericsson.com@dmarc.ietf.org> wrote:

> Hi,
>
>
>
> I saw that draft-ietf-sframe-enc uses AES-CTR with HMAC-SHA-256 for 32,
> 64, and 80 bit tags. 3GPP realised that 5G needs for something like AES-GCM
> with short tags a few years ago and asked ETSI SAGE (the CFRG of 3GPP) to
> suggest a solution. AES-GCM has quite bad properties if you truncate the
> tags.
>
>
>
> ETSI SAGE recently specified and recommended a mode based on AES-GCM but
> with some important differences. In addition to the GCM key H, the new mode
> uses an additional secret point 𝑄 which is multiplied in the last step,
> before the masking with the secret value. This allows short tags with
> good security properties. This type of construction is not new and can be
> in an old paper by Kaisa Nyberg. ETSI SAGE also recommends using a
> different polynomial taken from GCM-SIV for impoved performance compared to
> GCM but this is not needed for the trucation.
>
>
>
> Would SFRAME WG be interested in such an algorithm (AES-GCM with
> trucatable tags)? If so I could submit such a draft to to CFRG. ETSI SAGE
> has done quite a lot of security analysis on this.
>
>
>
> Cheers,
>
> John
> --
> Sframe mailing list
> Sframe@ietf.org
> https://www.ietf.org/mailman/listinfo/sframe
>