Subject: [Cfrg] AES-SIV versus AES-GCM for Encrypted Key Data

From: Paul Lambert <[email-masked]>
Date: Mon, 16 May 2016 19:35:23 +0000

AES-SIV does not seem to be popular with the NSA:

https://mentor.ieee.org/802.11/dcn/16/11-16-0596-01-00ai-more-counters.docx

This is a key wrapping application where GCM is being recommended over SIV mode for key wrapping.

I would think that nonce/counter misuse protection would be an advantage for this type of application.

Are there any clear technical benefits to using GCM versus SIV modes?

Paul

---

From: Russ Housley <[email-masked]>
Date: Mon, 16 May 2016 16:56:14 -0400

> I would think that nonce/counter misuse protection would be an advantage for this type of application.  

I do not see how.  There is a fresh key-encryption key for each wrap.  Where can the counter be reused.

Russ

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Mon, 16 May 2016 21:02:02 +0000

> can the counter be reused.

Are you saying that no two keys ever get encrypted with (wrapped by) the
same key-encryption key???

---

From: Paul Lambert <[email-masked]>
Date: Mon, 16 May 2016 21:20:51 +0000

Why would the NSA want to change an algorithm that apparently works (AES-SIV) with one that adds complexity in counter processing for this application?

AES-SIV (IMHO) has better properties for 'key wrapping' than AES-GCM.

While the key usage as currently specified in these draft specification might make a AES-GCM usable with careful utilization, it is a fragile construction that is not as readily extended because of the considerations of the counter usage.

Paul

Russ

---

From: Yoav Nir <[email-masked]>
Date: Tue, 17 May 2016 00:27:17 +0300

> On 17 May 2016, at 12:20 AM, Paul Lambert <[email-masked]> wrote:
> 
> 
> 
>> 
> Why would the NSA want to change an algorithm that apparently works (AES-SIV) with one that adds complexity in counter processing for this application?Yoav

The document says it’s because some parties require FIPS-approved algorithms, and AES-SIV is not a FIPS-approved algorithm. 

Interesting, but not binding on anyone who doesn’t require FIPS-approved algorithms.

Yoav

---

From: Paul Lambert <[email-masked]>
Date: Mon, 16 May 2016 21:31:23 +0000

The document says it's because some parties require FIPS-approved algorithms, and AES-SIV is not a FIPS-approved algorithm.

Interesting, but not binding on anyone who doesn't require FIPS-approved algorithms.

CCM and GCM modes were not FIPS approved when first adopted by industry.  NIST really should adopt a nonce misuse resistant mode.

I'm also not convinced that products would be rejected for used of this mode.  By the time products catch-up with the specifications NIST could approve or include this in their portfolio if willing.

Paul

Yoav

---

From: "Dan Harkins" <[email-masked]>
Date: Mon, 16 May 2016 17:30:36 -0700 (PDT)

> Where can the counter be reused.

  The application isn't really key wrapping, it's protection of some
handshaking messages for an authentication protocol. The resulting
security association is a bit longer-lived so subsequent packets for
on-going maintenance of the SA-- like rekeying traffic keys-- would use
the same (now "unfresh") key.

  Parts of the packet get encrypted and the whole thing gets
authentication. So instead of doing an ad hoc construction of cipher
(in CBC mode, or CTR mode, or ...) and MAC (HMAC-SHAXYZ) and making
sure the order is right it's easier to use a provably secure construction
that does authenticated encryption with AAD. Using one that doesn't
require any kind of additional nonce to be contributed is more attractive.
Robust misuse resistance is a virtue for a thing like this.

  regards,

  Dan.

> Russ
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>

---

From: Russ Housley <[email-masked]>
Date: Tue, 17 May 2016 09:50:33 -0400

> Why would the NSA want to change an algorithm that apparently works (AES-SIV) with one that adds complexity in counter processing for this application?

I do not speak for NSA.  However, NSA only uses algorithms and modes that are FIPS-approved.  AES-SIV does not meet that requirement.  If that happens in the future, then the direction might change.

Russ

---

From: Russ Housley <[email-masked]>
Date: Tue, 17 May 2016 09:54:19 -0400

> CCM and GCM modes were not FIPS approved when first adopted by industry.  NIST really should adopt a nonce misuse resistant mode.

At that point in history, there were no FIPS-approved AEAD algorithms.  Industry approached NIST and worked with them so that the algorithms became FIPS-approved at roughly the same time that the IEEE 802 standards that used there approved.  I think that it would have gone differently if there were already FIPS-approved AEAD algorithms at that time.

Russ

---

From: Russ Housley <[email-masked]>
Date: Tue, 17 May 2016 09:58:46 -0400

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 17 May 2016 15:04:29 +0100

On 17/05/16 14:50, Russ Housley wrote:
> I do not speak for NSA.  However, NSA only uses algorithms and modes
> that are FIPS-approved.  AES-SIV does not meet that requirement.  If
> that happens in the future, then the direction might change.

I don't speak for anyone:-)

I strongly believe that holding off from making improvements
of the basis of FIPS approval/certification is a really bad
idea. If a case can be made that the suggested change is less
good or no better than the FIPS approved/certified thing,
then that is a debate worth having, but waving the FIPS flag
is not itself IMO a good counter argument to a claim that
some change is an improvement.

And I'd be disappointed if an international organisation of
any kind did accept that kind of flag waving.

The fact that parts of the government in question were caught
cheating on exactly this kind process just a few years ago `
remains relevant to this discussion IMO. The fact that other
parts of the same government are good actors, IMO likely
including all those visibly involved, does not cancel that out.
In this case, that is another reason to not accept an argument
based solely on whether or not something has the blessing of
parts of that same govt. (And please do note that this paragraph
can equally be applied to any govt, not just the one concerned
here.)

S.

---

From: Russ Housley <[email-masked]>
Date: Tue, 17 May 2016 10:51:23 -0400

> some change is an improvement.

Your comments are beyond the context of the question at the front of this thread.

This thread was about a particular set of IEEE 802.11 ballot comments:
https://mentor.ieee.org/802.11/dcn/16/11-16-0596-01-00ai-more-counters.docx

> any kind did accept that kind of flag waving.

I guess that you are disappointed.  I understand that AES-SIV was selected over AES-GCM.

Russ

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 17 May 2016 16:12:28 +0100

Hiya,

On 17/05/16 15:51, Russ Housley wrote:
>>> I do not speak for NSA.  However, NSA only uses algorithms and
>>> modes that are FIPS-approved.  AES-SIV does not meet that
>>> requirement.  If that happens in the future, then the direction
>>> might change.
>> 
>> I strongly believe that holding off from making improvements of the
>> basis of FIPS approval/certification is a really bad idea. If a
>> case can be made that the suggested change is less good or no
>> better than the FIPS approved/certified thing, then that is a
>> debate worth having, but waving the FIPS flag is not itself IMO a
>> good counter argument to a claim that some change is an
>> improvement.
> 

Actually, I think my comments are relevant.

All IMO of course, but if IEEE decided to use AES-GCM and not
SIV on sound technical bases, that's fine. If however, IEEE
decided to use AES-GCM and not SIV solely or mostly due to the
FIPS argument, that's bad.

Earlier up-thread, the comment was made that FIPS approval is
a reason to go with GCM here and not SIV. I'm saying that's a
bad argument unless both schemes are otherwise the same in terms
of interesting technical properties.

>
> 
>> And I'd be disappointed if an international organisation of any
>> kind did accept that kind of flag waving.
> 

That's the opposite of what Peter's submission (in the URL above)
is suggesting. Has that been decided or is it still in play? Peter's
suggested change back to GCM is dated May 15th so I guessed that that
is still in progress.

Anyway, I'd only be disappointed if the decision process was driven
by FIPS approval and not by technical issues. (If there's nothing
to choose between proposals technically, then FIPS approval might be
an ok tie-breaker.)

Cheers,
S.

---

From: Russ Housley <[email-masked]>
Date: Tue, 17 May 2016 11:19:48 -0400

> suggested change back to GCM is dated May 15th so I guessed that that

My understanding is that the task group rejected the proposed changes yesterday.

Russ

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 17 May 2016 17:01:52 +0100

> My understanding is that the task group rejected the proposed changes yesterday.

Ah thanks. We're done here so I guess.

Cheers,
S.