Subject: Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Mon, 28 Mar 2016 14:39:00 +0000

On 3/28/16, 10:34 , "Cfrg on behalf of Paterson, Kenny"
<[email-masked] on behalf of [email-masked]> wrote:

>Dear CFRG,
>
>Shay, Adam and Yehuda have asked the CFRG chairs whether their draft for
>AES-GCM-SIV can be adopted as a CFRG document. We are minded to do so, but
>first wanted to canvass members of the group for their opinions on taking
>this step.

+1. Let’s do that.

>We are aware of the on-going CAESAR competition for AEAD schemes.
>AES-GCM-SIV is not a CAESAR candidate. CFRG adopting this document should
>not be interpreted as competing with or pre-empting the results of that
>very valuable activity. Indeed, once CAESAR is complete, we hope that some
>or all of the competition winners will end up being turned into RFCs under
>the auspices of CFRG.

+1 again.

>On 06/03/2016 03:50, "Cfrg on behalf of Shay Gueron"
><[email-masked] on behalf of [email-masked]> wrote:
>
>>Hello CFRG,
>>
>> 
>>We would like to draw your attention to our new submission draft entitled
>>“AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption”. Posted on
>>https://www.ietf.org/internet-drafts/draft-gueron-gcmsiv-00.txt
>> 
>>The submission specifies two authenticated encryption algorithms that are
>>nonce misuse-resistant. Their performance is expected to be roughly on
>>par with AES-GCM,
>> when run on modern processors that have AES instructions.
>> 
>>Security and performance analysis can be found in S. Gueron and Y.
>>Lindell. GCM-SIV: Full Nonce Misuse-Resistant Authenticated Encryption at
>>Under One Cycle
>> per Byte. In 22nd ACM CCS, pages 109-119, 2015.
>> 
>>We hope that the CFRG will take this up as a working-group item.
>> 
>>Thank you,
>>
>> 
>>Shay Gueron, Adam Langley, Yehuda Lindell
>> 
>>
>>
>
>_______________________________________________
>Cfrg mailing list
>[email-masked]
>https://www.irtf.org/mailman/listinfo/cfrg

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Mon, 28 Mar 2016 23:54:59 +0000

I can add to my point:

1. Desire to submit his/her CAESAR submission as an (Informational?) RFC for consideration by IRTF (and possibly later - IETF) is IMHO orthogonal to winning that competition. For example, Blake2 did not win the SHA3 contest, yet there's plenty of interest in having it included in various crypto libraries and protocols. Same goes for Skein. (Yes I know they did go through the process :)

2. It is not clear to me how exactly CAESAR is run, and how (& by who) the winner would be determined. I also don't know how well it held to its own suggested timeline, and how rigid the latter had been. 

Sent from my BlackBerry 10 smartphone on the Verizon Wireless 4G LTE network.
  Original Message  
From: Ted Krovetz
Sent: Monday, March 28, 2016 18:46
To: [email-masked]
Subject: Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document

> I don't want to pre-judge that issue, but it looks to me like it offers
> better performance than the comparable CAESAR candidates, at least on
> hardware with support for AES-NI and PCLMULQDQ instructions. What's your
> thinking on that?

We've seen AEZ achieve peak performance of 0.63 cpu cycles per byte on Intel Skylake and 1.3 cpu cycles per byte on Apple's A9. And because it doesn't use GF(2^128) operations, AEZ is likely much faster than AES-GCM-SIV on other architectures.

I don't want to make any claims of superiority, I just don't understand what the rush is. Once AES-GCM-SIV is an RFC and starts appearing in protocols, it will be very hard to displace, even if it's not the best choice.

Uri suggested that other proposed AEAD schemes interested in short-circuiting the CAESAR process could submit proposed RFCs to CFRG. Is that what you'd like?

-Ted