Subject: Re: [ntpwg] Nonce woes

From: Daniel Franke <[email-masked]>
Date: Wed, 1 Mar 2017 12:19:18 -0500

On 8/23/16, Daniel Franke <[email-masked]> wrote:
> That leaves the AES_SIV_CMAC family, which seems to offer all the
> properties we want: misuse-resistance and unlimited nonce length. The
> construction has a security proof and is well-studied. Unfortunately,
> there seem to be very few implementations: the only one I can find is
> part of hostapd and I have no idea if it has ever been audited (not
> that this would be a huge deal to do -- it's 188 lines of pretty
> straightforward code).

After reviewing the hostapd implementation of AES-SIV I concluded it
was unsuitable for use in NTS and wrote my own, which I released last
night.

https://github.com/dfoxfranke/libaes_siv
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: Sharon Goldberg <[email-masked]>
Date: Wed, 1 Mar 2017 09:28:48 -0800

Nice! But why is unsuitable?

-- 
Sharon Goldberg
Computer Science, Boston University
http://www.cs.bu.edu/~goldbe
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: Daniel Franke <[email-masked]>
Date: Wed, 1 Mar 2017 12:34:27 -0500

> Nice! But why is unsuitable?

Performance issues, branching on secrets, and dependence on too much
other hostapd-specific code.
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg