Subject: [Cfrg] Security analysis of draft-smyshlyaev-re-keying-00.txt

From: Watson Ladd <[email-masked]>
Date: Mon, 7 Nov 2016 09:58:05 -0800

Dear all,

draft-smyshlyaev-re-keying-00.txt fails to achieve its stated security
goals, for fairly trivial reasons.

Draft-smyshlyaev-re-keying-00 uses the same value of H for the entire
message. The authenticity bounds for GCM depend on the length of the
message, not the number of blocks encrypted with the same key.
Therefore this bounds are not improved by the rekeying mechanism
proposed. The probability of forgery is L/2^{-128} where L is the
length of the message, and therefore we do not have beyond-birthday
bound security with this proposed mechanism.

Sincerely,
Watson Ladd

---

From: "Stanislav V. Smyshlyaev" <[email-masked]>
Date: Mon, 7 Nov 2016 23:06:36 +0300

Dear Watson,
We've never stated any improvements of authenticity bounds.

(and, moreover, I don't think that the probability of L/2^{128} needs to be
decreased at all).

If you look at the preprint (http://eprint.iacr.org/2016/628.pdf) we cited,
you'll see that it's all about 1) increasing key lifetime regarding the
confidentiality bounds, 2) limiting the key exposure - both regarding
adversaries that apply classical methods (linear, differential etc.) and
side-channel attacks.

Regards,

Stanislav

2016-11-07 20:58 GMT+03:00 Watson Ladd <[email-masked]>:

> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>