Subject: Re: [Cfrg] Deoxys-II for AEAD

From: Vasily <[email-masked]>
Date: Fri, 22 Nov 2019 09:15:59 +0300

Hi all!

Please consider this comparison of Deoxys-II and the MGM AEAD mode, 
discussed at the IETF 105 CFRG:
https://datatracker.ietf.org/meeting/105/materials/slides-105-cfrg-introducing-mgm-multilinear-galois-mode, 
see slides 11 and 14.

MGM does not have a nonce-misuse resistant mode - but because of that 
the message can be processed online before waiting for the whole message 
and, moreover, it allows precomputations.

Also MGM allows crypto agility, since it is a general AEAD-mode that can 
be used with any block cipher, not limited to less studied (and not 
standardized) tweakable block ciphers, unlike Deoxys-II.

Cheers,
Vasily, TC 26

---

From: Thomas Peyrin <[email-masked]>
Date: Fri, 22 Nov 2019 17:00:31 +0800

Hi Vasily,

actually, note that unlike mentioned in your slides, Deoxys-II is
inverse free. Looking at your comparison table, it seems then that
Deoxys-II is the best candidate.

I believe we should not compare nonce-misuse resistant schemes (for
which you need to make two passes on the message if you want to reach
MRAE security notion) and nonce-respecting schemes. They have quite
different goals.

Actually, if going for nonce-respecting design, note that Deoxys-I was
part of our CAESAR submission and is a nonce-respecting mode. It is
fully online, twice faster than Deoxys-II (it is actually faster than
GCM according to Supercop benchmarks), and provides full n-bit
security (unlike GCM). Only one call to the internal primitive per
message block is needed for Deoxys-I (from what I can see, you need 2
calls and some multiplications per message block in MGM mode ?).

Regards,

Thomas.

Le ven. 22 nov. 2019 à 14:19, Vasily
<shishkin_va=[email-masked]> a écrit :
>
> Hi all!
>
> Please consider this comparison of Deoxys-II and the MGM AEAD mode, discussed at the IETF 105 CFRG:
> https://datatracker.ietf.org/meeting/105/materials/slides-105-cfrg-introducing-mgm-multilinear-galois-mode, see slides 11 and 14.
>
> MGM does not have a nonce-misuse resistant mode - but because of that the message can be processed online before waiting for the whole message and, moreover, it allows precomputations.
>
> Also MGM allows crypto agility, since it is a general AEAD-mode that can be used with any block cipher, not limited to less studied (and not standardized) tweakable block ciphers, unlike Deoxys-II.
>
> Cheers,
> Vasily, TC 26
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Fri, 22 Nov 2019 14:48:23 +0000

>    I believe we should not compare nonce-misuse resistant and nonce-respecting schemes. 

Agreed. 

>    part of our CAESAR submission and is a nonce-respecting mode.

And in general, I frown upon using a nonce-respecting design - unless one can *guarantee* there will be no misuse.