Subject: [Ntp] Switching NTS to AES-GCM-SIV?

From: Miroslav Lichvar <[email-masked]>
Date: Tue, 23 Apr 2019 17:46:16 +0200

Hi,

there is a new standard for AES-GCM-SIV

https://tools.ietf.org/html/rfc8452

In the list archive I found some comments that this algorithm was
rejected for being only a draft at the time. That has changed and we
may want to reconsider it as the mandatory algorithm required by NTS.
At the very least, the performance should be better, which I'd very
like to see improved, and there may be other advantages.

Is it too late for NTS to switch?

-- 
Miroslav Lichvar

---

From: Daniel Franke <[email-masked]>
Date: Tue, 23 Apr 2019 12:01:38 -0400

On Tue, Apr 23, 2019 at 11:46 AM Miroslav Lichvar <[email-masked]> wrote:
> [...]

Whether it's too late is debatable, but I don't think we should.
AES-GCM-SIV's misuse-resistance properties are weaker than AES-SIV's:
its security bounds gradually degrade if you reuse the same nonce too
many times. In mainstream use cases this isn't any cause for concern
because nonce reuse should be rare, but I don't want to encumber our
choice of MTI algorithm with the assumption that it will *never* be a
concern.

With that said, in all but weird exceptional cases that may or may not
exist, I definitely encourage implementers to support AES-GCM-SIV in
addition to AES-SIV, and to put AES-GCM-SIV ahead of AES-SIV in their
preference ordering when negotiating what to use.

---

From: Miroslav Lichvar <[email-masked]>
Date: Wed, 24 Apr 2019 10:16:53 +0200

> choice of MTI algorithm with the assumption that it will *never* be a

In what way is NTS different from the mainstream in expected nonce reuse?

> preference ordering when negotiating what to use.

I'm not sure I follow here. If you recommend implementations to
support and prefer AES-GCM-SIV, and it is found to be problematic in
the NTS use case later, what difference will it make that they already
support AES-SIV-CMAC? They will still need to be updated/reconfigured
to actually use it.

NTS implementations supporting both will just be more complex and have
a larger attack surface.

-- 
Miroslav Lichvar