Subject: [Cfrg] draft-mcgrew-auth-enc-03.txt

From: "Dan Harkins" <[email-masked]>
Date: Fri, 10 Aug 2007 14:31:01 -0700 (PDT)

Hi David,

  I have a couple questions about draft-mcgrew-auth-enc-03.txt.

  Section 4 states requirements for AEAD algorithms with respect to the
lengths of various inputs-- maximum amount of plaintext is P_MAX, maximum
amount of additional authenticated data is A_MAX, etc. Are these to be
treated as logical limits imposed by the particular mode (for instance
fixing q to 3 for CCM imposes a P_MAX limit that would not be so low
if q was greater) or are they to be treated as "safe" limits?

  If the latter then what is the guidance that this limit should provide?
Is it a soft limit under which one should be fine but the proven security
guarentee falls off after you reach the limit or is it a hard limit that
the cipher becomes too unsafe to use after you reach the limit? How should
another AEAD algorithm that wishes to have a number assigned out of the
registry define these maximums? SIV's counter is 128 bits, if it was
incremented mod 2^128 P_MAX logically would be 2^128 but SIV's security
guarantee falls off after 2^64 so should P_MAX be less?

  On a related note, for CCM the I-D defines P_MAX as 2^24-1 octets and
A_MAX as 2^64-1 octets. Theorem 1 in the Jonsson paper referenced as [J02]
in the draft gives a security proof of CCM and states that the adversarial
advantage, with a tag length of 128 bits and a cipher block size of 128
bits is a function of:

   (qf * 2^-128) + (lE + lF)^2 * 2^-128

where qf is the number of forgery queries, lE is total number of
applications of the block cipher in queries to the encryption oracle and
lF is the total number of applications of the block cipher for queries
to the forgery oracle.

  P_MAX plaintext is 2^22-1 applications of the block cipher and A_MAX
additional authenticated data is 2^62-1 applications of the block cipher.
That seems like it is quite far past the "safe" point. Or what am I
missing?

  thanks,

  Dan.

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg