Subject: Re: [CFRG] draft-irtf-cfrg-aead-limits lacks EAX and OCB

From: "Martin Thomson" <[email-masked]>
Date: Mon, 02 Aug 2021 10:34:13 +1000

I am not personally aware of any analysis of these modes that would be suitable.

The limits documented in RFC 7253 are generic, so there isn't much point in including them.  Or, stated differently, we wouldn't be improving the information available to a user of OCB if we did so.

If someone is able to contribute an OCB, EAX, or SIV, those would be welcome, but my preference would be to complete the work.

On Sat, Jul 31, 2021, at 15:08, Daniel Kahn Gillmor wrote:
> Hi CFRG and OpenPGP folks--
> 
> In the CFRG meeting today, i noticed that the AEAD Limits draft does not
> include a mention of EAX and OCB.
> 
> EAX and OCB are both candidates for inclusion in the forthcoming
> cryptographic refresh of OpenPGP
> (https://gitlab.com/openpgp-wg/rfc4880bis/-/blob/main/crypto-refresh.md).
> 
> I note that for OCB, RFC 7253 does include some suggestions of the kinds
> of limits that are appropriate.
> 
> I'm not skilled enough with the kind of analysis that's happening in
> these drafts to tell whether the guidance in 7253 translates into the
> same sort of answers that draft-irtf-cfrg-aead-limits is trying to
> systematize.
> 
> If it is, and CFRG folks find the limits in 7253 plausible, perhaps a
> new section in the AEAD limits draft could import the relevant figures
> and reference 7253?
> 
> I don't know of any comparable analysis for EAX, but if anyone can point
> to some, i'd be interested in seeing EAX analyzed as well.
> 
> Sorry to not have the chops to analyze this myself, but i'm hoping that
> someone in CFRG have enough capacity to at least look into it and tell
> me why it doesn't match.
> 
> Regards,
> 
>         --dkg
> 
> _______________________________________________
> CFRG mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
> 
> Attachments:
> * signature.asc