Subject: [Cfrg] I-D Action: draft-irtf-cfrg-gcmsiv-02.txt

From: [email-masked]
Date: Mon, 29 Aug 2016 08:37:19 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Crypto Forum of the IETF.

        Title           : AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption
        Authors         : Shay Gueron
                          Adam Langley
                          Yehuda Lindell
	Filename        : draft-irtf-cfrg-gcmsiv-02.txt
	Pages           : 89
	Date            : 2016-08-29

Abstract:
   This memo specifies two authenticated encryption algorithms that are
   nonce misuse-resistant - that is that they do not fail
   catastrophically if a nonce is repeated.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-irtf-cfrg-gcmsiv/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-irtf-cfrg-gcmsiv-02

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-gcmsiv-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Adam Langley <[email-masked]>
Date: Mon, 29 Aug 2016 08:40:16 -0700

> This draft is a work item of the Crypto Forum of the IETF.

Dear all,

We have just published an updated version of the AES-GCM-SIV draft.
The major change in this update is the use of nonce-specific POLYVAL
keys. Previous versions of GCM-SIV did not do this and, instead, used
part of the AEAD's key as the POLYVAL key. Bleichenbacher pointed out
(https://mailarchive.ietf.org/arch/msg/cfrg/qgh-Yxmj7CC7cq2YZLpmfGA3x-o)
that this allowed some unexpected behavior if AES-GCM-SIV is used
under the assumption that the additional data is confidential. In such
a case, an attacker who controls the AEAD key can force the POLYVAL
key to be zero. If a user uses this AEAD to authenticate messages
based on a secret additional-data value, then this would be insecure,
as the attacker could calculate a valid authenticator without knowing
the input. This does not violate the standard properties of an AEAD,
as the additional data is not assumed to be confidential. However, it
demonstrates that AES-GCM-SIV is not a drop-in replacement to AES-GCM
in this scenario. We want the AES-GCM-SIV AEADs to be robust to
plausible misuse and also to be drop-in replacements for AES-GCM, and
therefore derive nonce-specific POLYVAL keys to avoid this issue.

The source code implementations of AES-GCM-SIV are updated in
https://github.com/Shay-Gueron/AES-GCM-SIV.

Shay, Yehuda and Adam