Subject: [Cfrg] SIV for non-AES ciphers first draft

From: Neil Madden <[email-masked]>
Date: Thu, 22 Nov 2018 17:22:07 +0000

I have now uploaded a (very rough) first draft describing how to extend the SIV mode of operation to non-AES ciphers and MACs, as previously discussed on this list.

The I-D is available here: https://datatracker.ietf.org/doc/draft-madden-generalised-siv/
The source is on Github here: https://github.com/NeilMadden/draft-madden-generalised-siv

Feedback welcome. Hopefully I’ve managed to wrestle xml2rfc to produce the right output.

Kind regards,

Neil Madden

---

From: Paul Lambert <[email-masked]>
Date: Mon, 26 Nov 2018 00:07:58 -0800

On the draft …
Given the benefits of Blake2 and it’s similar construction to ChaCha, why not use Blake2 instead of HMAC-SHA-256?

Paul

> On Nov 22, 2018, at 9:22 AM, Neil Madden <[email-masked]> wrote:
> 
> The I-D is available here: https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dmadden-2Dgeneralised-2Dsiv_&d=DwIGaQ&c=qgVugHHq3rzouXkEXdxBNQ&r=oIg4FfS8P761BlhMPJ2ys3IvSyH4XQ12Mbj_mXrCAJs&m=5WQpmA8deCCE8ehAcBhR-0SwNWDHfNA7dEo1IVxbNUM&s=Bs8DJzvOJ6KwhzN8Yti0sRCdOT5r02Ho7m3qmNKJpuI&e=
> The source is on Github here: https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_NeilMadden_draft-2Dmadden-2Dgeneralised-2Dsiv&d=DwIGaQ&c=qgVugHHq3rzouXkEXdxBNQ&r=oIg4FfS8P761BlhMPJ2ys3IvSyH4XQ12Mbj_mXrCAJs&m=5WQpmA8deCCE8ehAcBhR-0SwNWDHfNA7dEo1IVxbNUM&s=qgsdZqOvSNNunN3u9v69TfSUfrP3mW7OV865Ui6qq8E&e=
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.irtf.org_mailman_listinfo_cfrg&d=DwIGaQ&c=qgVugHHq3rzouXkEXdxBNQ&r=oIg4FfS8P761BlhMPJ2ys3IvSyH4XQ12Mbj_mXrCAJs&m=5WQpmA8deCCE8ehAcBhR-0SwNWDHfNA7dEo1IVxbNUM&s=g8oGz_kyMuTTp26sl6yblddFB_S1C5LiXRE9KKXhvxw&e=

---

From: Neil Madden <[email-masked]>
Date: Mon, 26 Nov 2018 09:41:38 +0000

I’m not wedded to HMAC-SHA256, so Blake2 is an attractive option. I went with HMAC-SHA256 because it seems good enough and fairly ubiquitous.

If we went for Blake2 then there are a number of decisions to be made:

1. Do we pick Blake2b or Blake2s? My mild preference would be for the s variant as both cipher and MAC then work well on 32-bit systems and it requires less RAM.

2. Do we go for 256-bit auth tag (as now), or take advantage of Blake2’s variable length output to produce a 192-bit tag, exactly matching the nonce required for XChaCha? A 256-bit auth tag is probably excessive for most uses.

3. Do we use Blake2’s native keyed hash support or use HMAC-Blake2? See [1] for some arguments in favour of using HMAC, but then keyed Blake2 is (presumably) faster.

[1] http://noiseprotocol.org/noise.html#hash-functions-and-hashing

— Neil

> On 26 Nov 2018, at 08:07, Paul Lambert <[email-masked]> wrote:
> 
> On the draft …