Subject: Re: [Cfrg] Short Authentication Tags in AES-128-CCM

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Thu, 23 Jul 2015 13:58:12 +0000

I think OCB is a strong contender.

Sent from my BlackBerry 10 smartphone on the Verizon Wireless 4G LTE network.
  Original Message  
From: Aaron Zauner
Sent: Thursday, July 23, 2015 09:50
To: Paul Lambert
Cc: [email-masked]
Subject: Re: [Cfrg] Short Authentication Tags in AES-128-CCM

Paul Lambert wrote:
> Another option that has been picked up by byte-senstive standards groups
> is to use AES-SIV. The IV and integrity check are combined saving overall
> encapsulation size. Also, AES-SIV has a significant advantage that it
> does not require nonce/IV uniqueness. Setup is simplified for a pair-wise
> links. Broadcast/multicast is viable without complex nonce coordination.
> 
> AES-128-SIV is a much better option for small messages than tweaking
> AES-128-CCM. 
> 

FYI: I've an individual draft on AES-OCB. Rogaway filed an IPR exemption
today with IETF. OCB could be interesting for IoT stuff, but I guess CCM
is already used with some IEEE protocols.

https://datatracker.ietf.org/ipr/2640/
https://datatracker.ietf.org/doc/draft-zauner-tls-aes-ocb/

(A similar exemption is pending from IBM, they assured me it's coming
though)

Aaron