AES-GCM-SIV: Specification and Analysis [pdf]
eprint.iacr.org
AES-GCM-SIV: Specification and Analysis [pdf]
1–10 of 15 posts
Re: AES-GCM-SIV: Specification and Analysis [pdf]
#2Reading this first was helpful for me: https://www.lvh.io/posts/nonce-misuse-resistance-101.html
Re: AES-GCM-SIV: Specification and Analysis [pdf]
#3Sadly hard to read...I was away from the crypto world for too long!
Re: AES-GCM-SIV: Specification and Analysis [pdf]
#4For context, this is describing an updated AES-GCM-SIV construction following a number of attacks reported by NSA earlier this year:
https://mailarchive.ietf.org/arch/attach/cfrg/pdfL0pM_N.pdf
Several cryptographers have been wary of this construction, both because of the history of attacks and also because it generally hasn't lived up to the goals of (nonce) "misuse resistant authenticated encryption" as described in the seminal Rogaway paper on the matter:
https://eprint.iacr.org/2006/221.pdf
It will be interesting to see more analysis on the latest version. For the intended use case (QUIC ticket encryption) it would be helpful.
Re: AES-GCM-SIV: Specification and Analysis [pdf]
#5Going directly to CFRG with this kind of feels like stealing the thunder from the ongoing CAESAR competition.
Unfortunately the only misuse-resistant CAESAR candidate left in the running is AEZ, according to https://aezoo.compute.dtu.dk/doku.php.
Re: AES-GCM-SIV: Specification and Analysis [pdf]
#6For context, this is describing an updated AES-GCM-SIV construction following a number of attacks reported by NSA earlier this year: https://mailarchive.ietf.org/arch/attach/cfrg/pdfL0pM_N.pdf Several cryptographers have been wary of this construction, both because of the history of attacks and also because it generally hasn't lived up to the goals of (nonce) "misuse resistant authenticated encryption" as described i…
For the record: I'm not a cryptographer.
:)
Re: AES-GCM-SIV: Specification and Analysis [pdf]
#7Going directly to CFRG with this kind of feels like stealing the thunder from the ongoing CAESAR competition. Unfortunately the only misuse-resistant CAESAR candidate left in the running is AEZ, according to https://aezoo.compute.dtu.dk/doku.php .
yea. I don't get why HS1-SIV isn't in the next round.
Re: AES-GCM-SIV: Specification and Analysis [pdf]
#8Do I understand correctly that the change from GHASH to POLYVAL is basically saying "screw tradition, let's put Little Endian on the wire"?
In general, when you see Little Endian on the wire, that means someone forgot to call htonl() in their code.
Re: AES-GCM-SIV: Specification and Analysis [pdf]
#9Going directly to CFRG with this kind of feels like stealing the thunder from the ongoing CAESAR competition. Unfortunately the only misuse-resistant CAESAR candidate left in the running is AEZ, according to https://aezoo.compute.dtu.dk/doku.php .
This is incorrect. Deoxys also supports misuse-resistant as well. You just need to pick the right mode =).
Re: AES-GCM-SIV: Specification and Analysis [pdf]
#10Going directly to CFRG with this kind of feels like stealing the thunder from the ongoing CAESAR competition. Unfortunately the only misuse-resistant CAESAR candidate left in the running is AEZ, according to https://aezoo.compute.dtu.dk/doku.php .
yea. I don't get why HS1-SIV isn't in the next round.
Hardware performance might be the reason.