Subject: Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Sun, 17 Apr 2016 17:10:48 +0000

Thank you very much! I've tried the 128-bit so far, and confirm that ‎it compiles & runs fine on Mac OS X.

Sent from my BlackBerry 10 smartphone on the Verizon Wireless 4G LTE network.
From: Gueron, Shay
Sent: Sunday, April 17, 2016 12:58
To: Gueron, Shay; Blumenthal, Uri - 0553 - MITLL
Reply To: Gueron, Shay
Cc: [email-masked]; Yehuda Lindell; Adam Langley; Shay Gueron
Subject: Re[5]: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications

Hello everyone -
 
The asm code for MAC OS, for the 256-bit key is now also uploaded into the Github repository (https://github.com/Shay-Gueron/AES-GCM-SIV).
 
Regards, Shay
 
------ Original Message ------
From: "Gueron, Shay" <[email-masked]>
To: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>; "Shay Gueron" <[email-masked]>; "Yehuda Lindell" <[email-masked]>; "Adam Langley" <[email-masked]>
Sent: 4/14/2016 11:09:08 AM
Subject: Re[4]: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications
 
Hello everyone -
 
I uploaded an asm code version for MAC OS. It is in the Github repository (https://github.com/Shay-Gueron/AES-GCM-SIV).
 
Now it is the code for the 128-bit key variant (the 256-bit key variant will be uploaded next week).
 
Regards, Shay
 
------ Original Message ------
From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
To: "Gueron, Shay" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Sent: 4/10/2016 10:55:48 AM
Subject: Re: Re[2]: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications
 
If it was only the native Mac OS X assembler (whose GAS is known to be much behind the standard) it wouldn't be so bad.

But as I said - I've tried most every other assembler, including the "all-powerful" YASM that usually can process whatever I throw at it. YASM failed as well.

I'd appreciate if you could release a "more portable" hand-tuned version that could compile, e.g., under Yasm-1.3.0 (the current stable version).

C intrinsics would also be great - but hopefully not at the cost of hand-tuned code.

Thanks!

Sent from my BlackBerry 10 smartphone on the Verizon Wireless 4G LTE network.
From: Gueron, Shay
Sent: Sunday, April 10, 2016 09:39
To: Blumenthal, Uri - 0553 - MITLL; Adam Langley; Andy Lutomirski
Reply To: Gueron, Shay
Cc: Yehuda Lindell; [email-masked]; Adam Langley; Shay Gueron
Subject: Re[2]: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications

>>> BTW, what assembler is the optimized code supposed to work with?

The code that is currently posted was compiled and tested under Red Hat Linux, Fedora release 23, using GCC 4.8.2 & GNU assembly version 2.25.
 
MAC OS does not easily chew this assembler syntax, and some work needs to be done around it. However, I will soon post a C (intrinsics) version of the code, that should compile on all platforms (of course, at the cost of giving up some performance that hand tuned assembler achieves).
 
Regards, Shay

 

 

------ Original Message ------
From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
To: "Adam Langley" <[email-masked]>; "Andy Lutomirski" <[email-masked]>
Cc: "Yehuda Lindell" <[email-masked]>; "[email-masked]" <[email-masked]>; "Adam Langley" <[email-masked]>
Sent: 4/8/2016 5:40:27 AM
Subject: Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications
 
BTW, what assembler is the optimized code supposed to work with?
 
I'm on Mac OSX (10.10.5 and 10.11.4) using Xcode 7.2.1 and 7.3 correspondingly. Both systems also have gcc-5.3 and clang-3.7. I also t‎ried nasm, yasm. Nothing works. Would like some guidance. 
 
Sent from my BlackBerry 10 smartphone on the Verizon Wireless 4G LTE network.
  Original Message  
From: Adam Langley
Sent: Thursday, April 7, 2016 19:55
To: Andy Lutomirski
Cc: Yehuda Lindell; [email-masked]; Adam Langley
Subject: Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications
 
On Fri, Apr 8, 2016 at 8:16 AM, Andy Lutomirski <[email-masked]> wrote:
 Can you clarify the draft?
 
Will do as soon as I'm able (which should be next week).

Cheers
 
AGL
 
--
Adam Langley [email-masked] https://www.imperialviolet.org/
 
_______________________________________________
Cfrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/cfrg

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Thu, 21 Apr 2016 20:34:59 +0000

For the 3rd time: why not generate record key using AES-OFB?

Sent from my BlackBerry 10 smartphone on the Verizon Wireless 4G LTE network.
  Original Message  
From: Adam Langley
Sent: Thursday, April 21, 2016 16:28
To: Blumenthal, Uri - 0553 - MITLL
Cc: Shay Gueron; Andy Lutomirski; Yehuda Lindell; [email-masked]; Adam Langley
Subject: Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications

On Thu, Apr 21, 2016 at 1:11 PM, Blumenthal, Uri - 0553 - MITLL
<[email-masked]> wrote:
> I’m afraid Andy is correct. Say one record has its nonce xxxx…xxxx0 (127
> bits plus 0), and another record has its nonce xxx…xxx1. The record key
> produced for both records will be the same, because it clobbers/ignores the
> LSB.

That is what I understood when I wrote those words. I might have
misunderstood Shay however!

This is the reason that the Security Considerations section mentions
that it's only safe to repeat an nonce 2^31 (rather than 2^32) times
with the AES-256 version.

Cheers

AGL

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Thu, 21 Apr 2016 21:41:01 +0000

And if you're absolutely viscerally opposed to OFB - for the 1st encryption use the nonce itself, and for the 2nd encryption input - XOR the nonce with 0x00..01.

Sent from my BlackBerry 10 smartphone on the Verizon Wireless 4G LTE network.
  Original Message  
From: Blumenthal, Uri - 0553 - MITLL
Sent: Thursday, April 21, 2016 16:35
To: Adam Langley
Cc: Yehuda Lindell; [email-masked]; Adam Langley
Subject: Re: [Cfrg] Adopting "AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption" as a CFRG document ---- Some clarifications

Cheers

AGL