From: "Paterson, Kenny" <Kenny.Paterson@rhul.ac.uk>
To: Watson Ladd <watsonbladd@gmail.com>
Thread-Topic: [TLS] Randomization of nonces
Thread-Index: AQHR905nuk1eL7qDL0+R8CMs1lZU36BKr9vY
Date: Mon, 15 Aug 2016 23:46:25 +0000
Message-ID: <719DD3BC-83DD-4304-9C00-B72715A0FDA2@rhul.ac.uk>
References: <CACsn0cm04Fjh+mvvOCP6WL=OzF6Q81cRtO7bzFSLJPVjpeBFvQ@mail.gmail.com>
 <CACsn0c=V8dKXd_HVhAQd5ONeqQvmk5AmcVdWjJ8kFNG3189Hzg@mail.gmail.com>
 <CACsn0c=euLYSZWSoHs-QJgDLL1_HbMXXO2zVUDaf84Cyp22GgQ@mail.gmail.com>
 <CACsn0ck49LWFuDhXGzoRDN2ufRFOgNVT1-Q_p_mxQRHJouTc0Q@mail.gmail.com>
 <CACsn0cmPgp8KRTRgU4aOvoEjfLkEp8wG8=Yj-_6AbnkDq_qR_Q@mail.gmail.com>
 <CACsn0cnrPCVto9Ye=zR1zWg7gC-0HGo6ztALkXgzpKcMVz0FoQ@mail.gmail.com>,
 <CACsn0cmZ9Q+d6-7EUHJ-v-=hmK9yvFz_1fshAXnMRuwd2RQRFA@mail.gmail.com>
In-Reply-To: <CACsn0cmZ9Q+d6-7EUHJ-v-=hmK9yvFz_1fshAXnMRuwd2RQRFA@mail.gmail.com>
Accept-Language: en-GB, en-US
Content-Language: en-GB
received-spf: None (protection.outlook.com: rhul.ac.uk does not designate
 permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative;
 boundary="_000_719DD3BC83DD43049C00B72715A0FDA2rhulacuk_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Aug 2016 23:46:25.3857 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 2efd699a-1922-4e69-b601-108008d28a2e
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR03MB1822
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/8lAy8JUpTvG7cFwRkd-7c2k9DX4>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Randomization of nonces
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working
 group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>,
 <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>,
 <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 15 Aug 2016 23:46:31 -0000

--_000_719DD3BC83DD43049C00B72715A0FDA2rhulacuk_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Sadly, you can't implement XGCM using an existing AES-GCM API, because of t=
he way the MAC (which is keyed) is computed over the ciphertext in the stan=
dard GCM scheme.

This does not contradict what you wrote, but may be a barrier to adoption.

Cheers

Kenny

On 15 Aug 2016, at 16:40, Watson Ladd <watsonbladd@gmail.com<mailto:watsonb=
ladd@gmail.com>> wrote:


Dear TLS list,
Sitting in Santa Barbara I have just learned that our nonce randomization d=
oes slightly better then GCM in the multiuser setting. However, XGCM would =
produce even better security.

XGCM is GCM with masking applied to blocks before and after each encryption=
. It can be implemented on top counter mode and GHASH easily.

As an alternative we could use 256 bit keys.

Sincerely,
Watson Ladd

_______________________________________________
TLS mailing list
TLS@ietf.org<mailto:TLS@ietf.org>
https://www.ietf.org/mailman/listinfo/tls

--_000_719DD3BC83DD43049C00B72715A0FDA2rhulacuk_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
</head>
<body dir=3D"auto">
<div>Sadly, you can't implement XGCM using an existing AES-GCM API, because=
 of the way the MAC (which is keyed) is computed over the ciphertext in the=
 standard GCM scheme.&nbsp;</div>
<div><br>
</div>
<div>This does not contradict what you wrote, but may be a barrier to adopt=
ion.&nbsp;</div>
<div><br>
</div>
<div>Cheers</div>
<div><br>
</div>
<div>Kenny</div>
<div><br>
</div>
<div>On 15 Aug 2016, at 16:40, Watson Ladd &lt;<a href=3D"mailto:watsonblad=
d@gmail.com">watsonbladd@gmail.com</a>&gt; wrote:<br>
<br>
</div>
<blockquote type=3D"cite">
<div>
<p dir=3D"ltr">Dear TLS list,<br>
Sitting in Santa Barbara I have just learned that our nonce randomization d=
oes slightly better then GCM in the multiuser setting. However, XGCM would =
produce even better security.</p>
<p dir=3D"ltr">XGCM is GCM with masking applied to blocks before and after =
each encryption. It can be implemented on top counter mode and GHASH easily=
.</p>
<p dir=3D"ltr">As an alternative we could use 256 bit keys.</p>
<p dir=3D"ltr">Sincerely,<br>
Watson Ladd</p>
</div>
</blockquote>
<blockquote type=3D"cite">
<div><span>_______________________________________________</span><br>
<span>TLS mailing list</span><br>
<span><a href=3D"mailto:TLS@ietf.org">TLS@ietf.org</a></span><br>
<span><a href=3D"https://www.ietf.org/mailman/listinfo/tls">https://www.iet=
f.org/mailman/listinfo/tls</a></span><br>
</div>
</blockquote>
</body>
</html>

--_000_719DD3BC83DD43049C00B72715A0FDA2rhulacuk_--