Reconsidering the Security Bound of AES-GCM-SIV Tetsu Iwata 1 and - - PowerPoint PPT Presentation

▶
reconsidering the security bound of aes gcm siv
SMART_READER_LITE
LIVE PREVIEW

Reconsidering the Security Bound of AES-GCM-SIV Tetsu Iwata 1 and - - PowerPoint PPT Presentation

Dec 14, 2022 395 likes •1.12k views

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks Reconsidering the Security Bound of AES-GCM-SIV Tetsu Iwata 1 and Yannick Seurin 2 1 Nagoya University, Japan 2 ANSSI, France March 7, 2018 FSE 2018

slide-1
SLIDE 1

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Reconsidering the Security Bound of AES-GCM-SIV

Tetsu Iwata1 and Yannick Seurin2

1Nagoya University, Japan 2ANSSI, France

March 7, 2018 — FSE 2018

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 1 / 26

slide-2
SLIDE 2

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Summary of the contribution

  • we reconsider the security of the AEAD scheme AES-GCM-SIV

designed by Gueron, Langley, and Lindell

  • we identify flaws in the designers’ security analysis and propose a

new security proof

  • our findings leads to significantly reduced security claims,

especially for long messages

  • we propose a simple modification to the scheme (key derivation

function) improving security without efficiency loss

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 2 / 26

slide-3
SLIDE 3

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Summary of the contribution

  • we reconsider the security of the AEAD scheme AES-GCM-SIV

designed by Gueron, Langley, and Lindell

  • we identify flaws in the designers’ security analysis and propose a

new security proof

  • our findings leads to significantly reduced security claims,

especially for long messages

  • we propose a simple modification to the scheme (key derivation

function) improving security without efficiency loss

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 2 / 26

slide-4
SLIDE 4

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Summary of the contribution

  • we reconsider the security of the AEAD scheme AES-GCM-SIV

designed by Gueron, Langley, and Lindell

  • we identify flaws in the designers’ security analysis and propose a

new security proof

  • our findings leads to significantly reduced security claims,

especially for long messages

  • we propose a simple modification to the scheme (key derivation

function) improving security without efficiency loss

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 2 / 26

slide-5
SLIDE 5

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Summary of the contribution

  • we reconsider the security of the AEAD scheme AES-GCM-SIV

designed by Gueron, Langley, and Lindell

  • we identify flaws in the designers’ security analysis and propose a

new security proof

  • our findings leads to significantly reduced security claims,

especially for long messages

  • we propose a simple modification to the scheme (key derivation

function) improving security without efficiency loss

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 2 / 26

slide-6
SLIDE 6

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Outline

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 3 / 26

slide-7
SLIDE 7

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Outline

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 4 / 26

slide-8
SLIDE 8

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

History of (AES)-GCM-(SIV) AEAD schemes

  • GCM [MV04]
  • CTR encryption + Wegman-Carter MAC
  • Encrypt-then-MAC composition
  • widely deployed, not nonce-misuse resistant [Jou06, BZD+16]
  • GCM-SIV [GL15]
  • same components as GCM
  • Synthetic IV (SIV) composition [RS06]
  • nonce-misuse resistant
  • AES-GCM-SIV [GLL16, GLL17]
  • = GCM-SIV instantiated with AES
  • similar to GCM-SIV but three modifications:
  • universal hash function (POLYVAL instead of GHASH)
  • full-block counter
  • nonce-based key derivation (K, N) → (Kpolyval, KBC)
  • proposed for standardization at IETF CFRG
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 5 / 26

slide-9
SLIDE 9

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

History of (AES)-GCM-(SIV) AEAD schemes

  • GCM [MV04]
  • CTR encryption + Wegman-Carter MAC
  • Encrypt-then-MAC composition
  • widely deployed, not nonce-misuse resistant [Jou06, BZD+16]
  • GCM-SIV [GL15]
  • same components as GCM
  • Synthetic IV (SIV) composition [RS06]
  • nonce-misuse resistant
  • AES-GCM-SIV [GLL16, GLL17]
  • = GCM-SIV instantiated with AES
  • similar to GCM-SIV but three modifications:
  • universal hash function (POLYVAL instead of GHASH)
  • full-block counter
  • nonce-based key derivation (K, N) → (Kpolyval, KBC)
  • proposed for standardization at IETF CFRG
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 5 / 26

slide-10
SLIDE 10

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

History of (AES)-GCM-(SIV) AEAD schemes

  • GCM [MV04]
  • CTR encryption + Wegman-Carter MAC
  • Encrypt-then-MAC composition
  • widely deployed, not nonce-misuse resistant [Jou06, BZD+16]
  • GCM-SIV [GL15]
  • same components as GCM
  • Synthetic IV (SIV) composition [RS06]
  • nonce-misuse resistant
  • AES-GCM-SIV [GLL16, GLL17]
  • = GCM-SIV instantiated with AES
  • similar to GCM-SIV but three modifications:
  • universal hash function (POLYVAL instead of GHASH)
  • full-block counter
  • nonce-based key derivation (K, N) → (Kpolyval, KBC)
  • proposed for standardization at IETF CFRG
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 5 / 26

slide-11
SLIDE 11

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

History of (AES)-GCM-(SIV) AEAD schemes

  • GCM [MV04]
  • CTR encryption + Wegman-Carter MAC
  • Encrypt-then-MAC composition
  • widely deployed, not nonce-misuse resistant [Jou06, BZD+16]
  • GCM-SIV [GL15]
  • same components as GCM
  • Synthetic IV (SIV) composition [RS06]
  • nonce-misuse resistant
  • AES-GCM-SIV [GLL16, GLL17]
  • = GCM-SIV instantiated with AES
  • similar to GCM-SIV but three modifications:
  • universal hash function (POLYVAL instead of GHASH)
  • full-block counter
  • nonce-based key derivation (K, N) → (Kpolyval, KBC)
  • proposed for standardization at IETF CFRG
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 5 / 26

slide-12
SLIDE 12

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

History of (AES)-GCM-(SIV) AEAD schemes

  • GCM [MV04]
  • CTR encryption + Wegman-Carter MAC
  • Encrypt-then-MAC composition
  • widely deployed, not nonce-misuse resistant [Jou06, BZD+16]
  • GCM-SIV [GL15]
  • same components as GCM
  • Synthetic IV (SIV) composition [RS06]
  • nonce-misuse resistant
  • AES-GCM-SIV [GLL16, GLL17]
  • = GCM-SIV instantiated with AES
  • similar to GCM-SIV but three modifications:
  • universal hash function (POLYVAL instead of GHASH)
  • full-block counter
  • nonce-based key derivation (K, N) → (Kpolyval, KBC)
  • proposed for standardization at IETF CFRG
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 5 / 26

slide-13
SLIDE 13

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

History of (AES)-GCM-(SIV) AEAD schemes

  • GCM [MV04]
  • CTR encryption + Wegman-Carter MAC
  • Encrypt-then-MAC composition
  • widely deployed, not nonce-misuse resistant [Jou06, BZD+16]
  • GCM-SIV [GL15]
  • same components as GCM
  • Synthetic IV (SIV) composition [RS06]
  • nonce-misuse resistant
  • AES-GCM-SIV [GLL16, GLL17]
  • = GCM-SIV instantiated with AES
  • similar to GCM-SIV but three modifications:
  • universal hash function (POLYVAL instead of GHASH)
  • full-block counter
  • nonce-based key derivation (K, N) → (Kpolyval, KBC)
  • proposed for standardization at IETF CFRG
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 5 / 26

slide-14
SLIDE 14

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

History of (AES)-GCM-(SIV) AEAD schemes

  • GCM [MV04]
  • CTR encryption + Wegman-Carter MAC
  • Encrypt-then-MAC composition
  • widely deployed, not nonce-misuse resistant [Jou06, BZD+16]
  • GCM-SIV [GL15]
  • same components as GCM
  • Synthetic IV (SIV) composition [RS06]
  • nonce-misuse resistant
  • AES-GCM-SIV [GLL16, GLL17]
  • = GCM-SIV instantiated with AES
  • similar to GCM-SIV but three modifications:
  • universal hash function (POLYVAL instead of GHASH)
  • full-block counter
  • nonce-based key derivation (K, N) → (Kpolyval, KBC)
  • proposed for standardization at IETF CFRG
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 5 / 26

slide-15
SLIDE 15

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

History of (AES)-GCM-(SIV) AEAD schemes

  • GCM [MV04]
  • CTR encryption + Wegman-Carter MAC
  • Encrypt-then-MAC composition
  • widely deployed, not nonce-misuse resistant [Jou06, BZD+16]
  • GCM-SIV [GL15]
  • same components as GCM
  • Synthetic IV (SIV) composition [RS06]
  • nonce-misuse resistant
  • AES-GCM-SIV [GLL16, GLL17]
  • = GCM-SIV instantiated with AES
  • similar to GCM-SIV but three modifications:
  • universal hash function (POLYVAL instead of GHASH)
  • full-block counter
  • nonce-based key derivation (K, N) → (Kpolyval, KBC)
  • proposed for standardization at IETF CFRG
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 5 / 26

slide-16
SLIDE 16

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

History of (AES)-GCM-(SIV) AEAD schemes

  • GCM [MV04]
  • CTR encryption + Wegman-Carter MAC
  • Encrypt-then-MAC composition
  • widely deployed, not nonce-misuse resistant [Jou06, BZD+16]
  • GCM-SIV [GL15]
  • same components as GCM
  • Synthetic IV (SIV) composition [RS06]
  • nonce-misuse resistant
  • AES-GCM-SIV [GLL16, GLL17]
  • = GCM-SIV instantiated with AES
  • similar to GCM-SIV but three modifications:
  • universal hash function (POLYVAL instead of GHASH)
  • full-block counter
  • nonce-based key derivation (K, N) → (Kpolyval, KBC)
  • proposed for standardization at IETF CFRG
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 5 / 26

slide-17
SLIDE 17

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

History of (AES)-GCM-(SIV) AEAD schemes

  • GCM [MV04]
  • CTR encryption + Wegman-Carter MAC
  • Encrypt-then-MAC composition
  • widely deployed, not nonce-misuse resistant [Jou06, BZD+16]
  • GCM-SIV [GL15]
  • same components as GCM
  • Synthetic IV (SIV) composition [RS06]
  • nonce-misuse resistant
  • AES-GCM-SIV [GLL16, GLL17]
  • = GCM-SIV instantiated with AES
  • similar to GCM-SIV but three modifications:
  • universal hash function (POLYVAL instead of GHASH)
  • full-block counter
  • nonce-based key derivation (K, N) → (Kpolyval, KBC)
  • proposed for standardization at IETF CFRG
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 5 / 26

slide-18
SLIDE 18

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

History of (AES)-GCM-(SIV) AEAD schemes

  • GCM [MV04]
  • CTR encryption + Wegman-Carter MAC
  • Encrypt-then-MAC composition
  • widely deployed, not nonce-misuse resistant [Jou06, BZD+16]
  • GCM-SIV [GL15]
  • same components as GCM
  • Synthetic IV (SIV) composition [RS06]
  • nonce-misuse resistant
  • AES-GCM-SIV [GLL16, GLL17]
  • = GCM-SIV instantiated with AES
  • similar to GCM-SIV but three modifications:
  • universal hash function (POLYVAL instead of GHASH)
  • full-block counter
  • nonce-based key derivation (K, N) → (Kpolyval, KBC)
  • proposed for standardization at IETF CFRG
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 5 / 26

slide-19
SLIDE 19

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

History of (AES)-GCM-(SIV) AEAD schemes

  • GCM [MV04]
  • CTR encryption + Wegman-Carter MAC
  • Encrypt-then-MAC composition
  • widely deployed, not nonce-misuse resistant [Jou06, BZD+16]
  • GCM-SIV [GL15]
  • same components as GCM
  • Synthetic IV (SIV) composition [RS06]
  • nonce-misuse resistant
  • AES-GCM-SIV [GLL16, GLL17]
  • = GCM-SIV instantiated with AES
  • similar to GCM-SIV but three modifications:
  • universal hash function (POLYVAL instead of GHASH)
  • full-block counter
  • nonce-based key derivation (K, N) → (Kpolyval, KBC)
  • proposed for standardization at IETF CFRG
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 5 / 26

slide-20
SLIDE 20

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

History of (AES)-GCM-(SIV) AEAD schemes

  • GCM [MV04]
  • CTR encryption + Wegman-Carter MAC
  • Encrypt-then-MAC composition
  • widely deployed, not nonce-misuse resistant [Jou06, BZD+16]
  • GCM-SIV [GL15]
  • same components as GCM
  • Synthetic IV (SIV) composition [RS06]
  • nonce-misuse resistant
  • AES-GCM-SIV [GLL16, GLL17]
  • = GCM-SIV instantiated with AES
  • similar to GCM-SIV but three modifications:
  • universal hash function (POLYVAL instead of GHASH)
  • full-block counter
  • nonce-based key derivation (K, N) → (Kpolyval, KBC)
  • proposed for standardization at IETF CFRG
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 5 / 26

slide-21
SLIDE 21

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

History of (AES)-GCM-(SIV) AEAD schemes

  • GCM [MV04]
  • CTR encryption + Wegman-Carter MAC
  • Encrypt-then-MAC composition
  • widely deployed, not nonce-misuse resistant [Jou06, BZD+16]
  • GCM-SIV [GL15]
  • same components as GCM
  • Synthetic IV (SIV) composition [RS06]
  • nonce-misuse resistant
  • AES-GCM-SIV [GLL16, GLL17]
  • = GCM-SIV instantiated with AES
  • similar to GCM-SIV but three modifications:
  • universal hash function (POLYVAL instead of GHASH)
  • full-block counter
  • nonce-based key derivation (K, N) → (Kpolyval, KBC)
  • proposed for standardization at IETF CFRG
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 5 / 26

slide-22
SLIDE 22

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

History of (AES)-GCM-(SIV) AEAD schemes

  • GCM [MV04]
  • CTR encryption + Wegman-Carter MAC
  • Encrypt-then-MAC composition
  • widely deployed, not nonce-misuse resistant [Jou06, BZD+16]
  • GCM-SIV [GL15]
  • same components as GCM
  • Synthetic IV (SIV) composition [RS06]
  • nonce-misuse resistant
  • AES-GCM-SIV [GLL16, GLL17]
  • = GCM-SIV instantiated with AES
  • similar to GCM-SIV but three modifications:
  • universal hash function (POLYVAL instead of GHASH)
  • full-block counter
  • nonce-based key derivation (K, N) → (Kpolyval, KBC)
  • proposed for standardization at IETF CFRG
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 5 / 26

slide-23
SLIDE 23

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Nonce-Based Authenticated Encryption (nAE)

Syntax

A nAE scheme Π is a pair of algorithms (Π.Enc, Π.Dec) where

  • algorithm Π.Enc takes
  • (a key K)
  • a nonce N
  • associated data A
  • a message M

and returns a ciphertext C.

  • algorithm Π.Dec takes K and (N, A, C) and returns M or ⊥.
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 6 / 26

slide-24
SLIDE 24

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Nonce-Based Authenticated Encryption (nAE)

EncK(·, ·, ·) DecK(·, ·, ·) A 0/1 (N, A, M) (N, A, C) $(·, ·, ·) ⊥(·, ·, ·) A 0/1 (N, A, M) (N, A, C)

Security (all-in-one definition)

  • The scheme Π is secure if adversary A cannot distinguish

(EncK, DecK) and ($, ⊥).

  • A cannot ask a decryption query (N, A, C) if it received C from

an encryption query (N, A, M)

  • A is said nonce-respecting if it never repeats a nonce in

encryption queries.

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 7 / 26

slide-25
SLIDE 25

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Misuse-Resistant AE (MRAE)

Nonce-misuse resistance (informal) [RS06]

A nAE scheme is said nonce-misuse resistant if repeating a nonce in encryption queries:

  • does not harm authenticity
  • hurts confidentiality only insofar as repetitions of triplets

(N, A, M) are detectable

  • ≃ deterministic authenticated encryption
  • MRAE schemes cannot be online (each ciphertext bit must

depend on each input bit)

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 8 / 26

slide-26
SLIDE 26

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Misuse-Resistant AE (MRAE)

Nonce-misuse resistance (informal) [RS06]

A nAE scheme is said nonce-misuse resistant if repeating a nonce in encryption queries:

  • does not harm authenticity
  • hurts confidentiality only insofar as repetitions of triplets

(N, A, M) are detectable

  • ≃ deterministic authenticated encryption
  • MRAE schemes cannot be online (each ciphertext bit must

depend on each input bit)

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 8 / 26

slide-27
SLIDE 27

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Misuse-Resistant AE (MRAE)

Nonce-misuse resistance (informal) [RS06]

A nAE scheme is said nonce-misuse resistant if repeating a nonce in encryption queries:

  • does not harm authenticity
  • hurts confidentiality only insofar as repetitions of triplets

(N, A, M) are detectable

  • ≃ deterministic authenticated encryption
  • MRAE schemes cannot be online (each ciphertext bit must

depend on each input bit)

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 8 / 26

slide-28
SLIDE 28

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

SIV composition method

FK1 Π.EncK2 N M A

  • SIV (Synthetic IV) [RS06] combines a PRF FK1(N, A, M) and an

IV-based encryption scheme Π.EncK2(IV , M)

  • provides nonce-misuse resistance: any change to N, A, or M

randomly modifies the tag and C

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 9 / 26

slide-29
SLIDE 29

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

SIV composition method

FK1 Π.EncK2 N M A tag

  • SIV (Synthetic IV) [RS06] combines a PRF FK1(N, A, M) and an

IV-based encryption scheme Π.EncK2(IV , M)

  • provides nonce-misuse resistance: any change to N, A, or M

randomly modifies the tag and C

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 9 / 26

slide-30
SLIDE 30

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

SIV composition method

FK1 Π.EncK2 N M A tag Conv IV

  • SIV (Synthetic IV) [RS06] combines a PRF FK1(N, A, M) and an

IV-based encryption scheme Π.EncK2(IV , M)

  • provides nonce-misuse resistance: any change to N, A, or M

randomly modifies the tag and C

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 9 / 26

slide-31
SLIDE 31

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

SIV composition method

FK1 Π.EncK2 N M A tag Conv IV C

  • SIV (Synthetic IV) [RS06] combines a PRF FK1(N, A, M) and an

IV-based encryption scheme Π.EncK2(IV , M)

  • provides nonce-misuse resistance: any change to N, A, or M

randomly modifies the tag and C

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 9 / 26

slide-32
SLIDE 32

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

SIV composition method

FK1 Π.EncK2 N M A tag Conv IV C

  • SIV (Synthetic IV) [RS06] combines a PRF FK1(N, A, M) and an

IV-based encryption scheme Π.EncK2(IV , M)

  • provides nonce-misuse resistance: any change to N, A, or M

randomly modifies the tag and C

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 9 / 26

slide-33
SLIDE 33

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Details of AES-GCM-SIV

POLYVAL K1 Encode M A Truncn

1

N EK2 T T U N KeyDer K K1 K2 M0 Mℓ

1

C0 Cℓ

1

zero-pad

127 127

Truncn

1

1 EK2 M1 C1 1 EK2 1 1 EK2 1

96

  • AES-GCM-SIV = KeyDer + GCM-SIV+
  • same BC key K2 used in MAC and encryption

⇒ 0/1 domain separation

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 10 / 26

slide-34
SLIDE 34

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Outline

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 11 / 26

slide-35
SLIDE 35

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Designers’ claims ([GLL17], Theorem 6)

Advmrae

AES-GCM-SIV(A) ≤ Advprp

AES(A′′) + min

  • 36Q2

2129 , 6Q 296

  • KeyDer PRF-security

+ Q

  • 2Advprf

AES(A′) + R2ℓM

2126 + R2 + 2qD 2127

  • GCM-SIV+ MRAE-security

,

  • ℓM = maximal message length of encryption queries
  • Q = maximal number of distinct nonces in encryption queries
  • R = maximal number of nonce repetitions in encryption queries
  • qD = number of decryption queries per nonce, σD = total length
  • A′ makes at most Q(2R + 2qD + σD) queries
  • A′′ makes at most 6Q queries
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 12 / 26

slide-36
SLIDE 36

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Designers’ claims ([GLL17], Theorem 6)

Advmrae

AES-GCM-SIV(A) ≤ Advprp

AES(A′′) + min

  • 36Q2

2129 , 6Q 296

  • KeyDer PRF-security

+ Q

  • 2Advprf

AES(A′) + R2ℓM

2126 + R2 + 2qD 2127

  • GCM-SIV+ MRAE-security

,

  • ℓM = maximal message length of encryption queries
  • Q = maximal number of distinct nonces in encryption queries
  • R = maximal number of nonce repetitions in encryption queries
  • qD = number of decryption queries per nonce, σD = total length
  • A′ makes at most Q(2R + 2qD + σD) queries
  • A′′ makes at most 6Q queries
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 12 / 26

slide-37
SLIDE 37

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Designers’ claims ([GLL17], Theorem 6)

Advmrae

AES-GCM-SIV(A) ≤ Advprp

AES(A′′) + min

  • 36Q2

2129 , 6Q 296

  • KeyDer PRF-security

+ Q

  • 2Advprf

AES(A′) + R2ℓM

2126 + R2 + 2qD 2127

  • GCM-SIV+ MRAE-security

,

  • ℓM = maximal message length of encryption queries
  • Q = maximal number of distinct nonces in encryption queries
  • R = maximal number of nonce repetitions in encryption queries
  • qD = number of decryption queries per nonce, σD = total length
  • A′ makes at most Q(2R + 2qD + σD) queries
  • A′′ makes at most 6Q queries
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 12 / 26

slide-38
SLIDE 38

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Problems in designers’ bound

Advmrae

AES-GCM-SIV(A) ≤ Advprp

AES(A′′) + min

  • 36Q2

2129 , 6Q 296

  • + Q
  • 2Advprf

AES(A′) + R2ℓM

2126 + R2 + 2qD 2127

  • mixes PRP- and PRF-security of the underlying BC
  • AD’s length not taken into account
  • number of queries Q(2R + 2qD + σD) of A′ is flawed
  • Q = 0 (no encryption queries), qD > 0 ⇒ Advmrae

AES-GCM-SIV(A) = 0

→ impossible for MRAE security definition (non-zero probability to forge a tag randomly)

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 13 / 26

slide-39
SLIDE 39

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Problems in designers’ bound

Advmrae

AES-GCM-SIV(A) ≤ Advprp

AES(A′′) + min

  • 36Q2

2129 , 6Q 296

  • + Q
  • 2Advprf

AES(A′) + R2ℓM

2126 + R2 + 2qD 2127

  • mixes PRP- and PRF-security of the underlying BC
  • AD’s length not taken into account
  • number of queries Q(2R + 2qD + σD) of A′ is flawed
  • Q = 0 (no encryption queries), qD > 0 ⇒ Advmrae

AES-GCM-SIV(A) = 0

→ impossible for MRAE security definition (non-zero probability to forge a tag randomly)

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 13 / 26

slide-40
SLIDE 40

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Problems in designers’ bound

Advmrae

AES-GCM-SIV(A) ≤ Advprp

AES(A′′) + min

  • 36Q2

2129 , 6Q 296

  • + Q
  • 2Advprf

AES(A′) + R2ℓM

2126 + R2 + 2qD 2127

  • mixes PRP- and PRF-security of the underlying BC
  • AD’s length not taken into account
  • number of queries Q(2R + 2qD + σD) of A′ is flawed
  • Q = 0 (no encryption queries), qD > 0 ⇒ Advmrae

AES-GCM-SIV(A) = 0

→ impossible for MRAE security definition (non-zero probability to forge a tag randomly)

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 13 / 26

slide-41
SLIDE 41

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Problems in designers’ bound

Advmrae

AES-GCM-SIV(A) ≤ Advprp

AES(A′′) + min

  • 36Q2

2129 , 6Q 296

  • + Q
  • 2Advprf

AES(A′) + R2ℓM

2126 + R2 + 2qD 2127

  • mixes PRP- and PRF-security of the underlying BC
  • AD’s length not taken into account
  • number of queries Q(2R + 2qD + σD) of A′ is flawed
  • Q = 0 (no encryption queries), qD > 0 ⇒ Advmrae

AES-GCM-SIV(A) = 0

→ impossible for MRAE security definition (non-zero probability to forge a tag randomly)

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 13 / 26

slide-42
SLIDE 42

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Corrected security bound (privacy only)

If qD = 0 (no decryption queries), then Advmrae

AES-GCM-SIV(A) ≤ Advprp

AES(A′′) + min

  • 36Q2

2129 , 6Q 296

  • + QAdvprf

AES(A′) + QR2ℓM

2126 + QR2ℓA 2128 Main changes:

  • takes into account ℓA = maximal length of AD
  • A′ makes RℓM queries versus 2QR in [GLL17]
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 14 / 26

slide-43
SLIDE 43

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Corrected security bound (privacy only)

If qD = 0 (no decryption queries), then Advmrae

AES-GCM-SIV(A) ≤ Advprp

AES(A′′) + min

  • 36Q2

2129 , 6Q 296

  • + QAdvprf

AES(A′) + QR2ℓM

2126 + QR2ℓA 2128 Main changes:

  • takes into account ℓA = maximal length of AD
  • A′ makes RℓM queries versus 2QR in [GLL17]
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 14 / 26

slide-44
SLIDE 44

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Dominating term

Advmrae

AES-GCM-SIV(A) ≤ Advprp

AES(A′′) + min

  • 36Q2

2129 , 6Q 296

  • + QAdvprf

AES(A′) + QR2ℓM

2126 + QR2ℓA 2128 ,

  • [GLL17] claimed the security bound is dominated by QR2ℓM

2126

(accounts for counter collision)

  • but in fact the PRF term is ∼ ℓM larger (A′ makes RℓM queries)

QAdvprf

AES(A′) ≃ QAdvprp AES(A′) + QR2ℓ2 M

2129

  • the bound is tight and matched by a simple distinguishing attack
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 15 / 26

slide-45
SLIDE 45

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Dominating term

Advmrae

AES-GCM-SIV(A) ≤ Advprp

AES(A′′) + min

  • 36Q2

2129 , 6Q 296

  • + QAdvprf

AES(A′) + QR2ℓM

2126 + QR2ℓA 2128 ,

  • [GLL17] claimed the security bound is dominated by QR2ℓM

2126

(accounts for counter collision)

  • but in fact the PRF term is ∼ ℓM larger (A′ makes RℓM queries)

QAdvprf

AES(A′) ≃ QAdvprp AES(A′) + QR2ℓ2 M

2129

  • the bound is tight and matched by a simple distinguishing attack
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 15 / 26

slide-46
SLIDE 46

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Dominating term

Advmrae

AES-GCM-SIV(A) ≤ Advprp

AES(A′′) + min

  • 36Q2

2129 , 6Q 296

  • + QAdvprf

AES(A′) + QR2ℓM

2126 + QR2ℓA 2128 ,

  • [GLL17] claimed the security bound is dominated by QR2ℓM

2126

(accounts for counter collision)

  • but in fact the PRF term is ∼ ℓM larger (A′ makes RℓM queries)

QAdvprf

AES(A′) ≃ QAdvprp AES(A′) + QR2ℓ2 M

2129

  • the bound is tight and matched by a simple distinguishing attack
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 15 / 26

slide-47
SLIDE 47

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Concrete security claims

Scheme NE Q R ℓM

  • ur bound

[GLL17] claim AES-GCM-SIV 232 232 1 232 2−33 2−61 (nonce based) 264 264 1 232 2−1 2−29 231 1 231 232 2−3 2−32 231 1 231 216 2−35 2−48 239 1 239 216 2−19 2−32 242 1 242 210 2−25 2−32 250 242 28 232 2−7 2−36 250 242 28 216 2−39 2−51 250 246 24 232 2−11 2−40 AES-GCM-SIV 248 — — 232 2−14 2−44 (random IV) 263 — — 216 2−31 2−32

NE = QR = total number of encryption queries

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 16 / 26

slide-48
SLIDE 48

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Taking decryption queries into account

  • the adversary can choose nonces freely in decryption queries

(it could reuse the same nonce qD times)

  • naive bound (Q + qD distinct nonces)

Advmrae

AES-GCM-SIV(A) ≤ (Q + qD)

  • (· · · ) + (R + qD)2(ℓM + ℓA)

2n

  • GCM-SIV+ security
  • loose bound (cubic in qD)
  • with a more careful multi-user analysis we recover a bound

quadratic in qD

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 17 / 26

slide-49
SLIDE 49

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Taking decryption queries into account

  • the adversary can choose nonces freely in decryption queries

(it could reuse the same nonce qD times)

  • naive bound (Q + qD distinct nonces)

Advmrae

AES-GCM-SIV(A) ≤ (Q + qD)

  • (· · · ) + (R + qD)2(ℓM + ℓA)

2n

  • GCM-SIV+ security
  • loose bound (cubic in qD)
  • with a more careful multi-user analysis we recover a bound

quadratic in qD

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 17 / 26

slide-50
SLIDE 50

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Taking decryption queries into account

  • the adversary can choose nonces freely in decryption queries

(it could reuse the same nonce qD times)

  • naive bound (Q + qD distinct nonces)

Advmrae

AES-GCM-SIV(A) ≤ (Q + qD)

  • (· · · ) + (R + qD)2(ℓM + ℓA)

2n

  • GCM-SIV+ security
  • loose bound (cubic in qD)
  • with a more careful multi-user analysis we recover a bound

quadratic in qD

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 17 / 26

slide-51
SLIDE 51

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Taking decryption queries into account

  • the adversary can choose nonces freely in decryption queries

(it could reuse the same nonce qD times)

  • naive bound (Q + qD distinct nonces)

Advmrae

AES-GCM-SIV(A) ≤ (Q + qD)

  • (· · · ) + (R + qD)2(ℓM + ℓA)

2n

  • GCM-SIV+ security
  • loose bound (cubic in qD)
  • with a more careful multi-user analysis we recover a bound

quadratic in qD

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 17 / 26

slide-52
SLIDE 52

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Outline

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 18 / 26

slide-53
SLIDE 53

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Key Derivation Function

  • (K, N)

KeyDer

− − − − → (K1, K2) constructed from E

  • standard PRP-to-PRF conversion problem
  • based on truncation [HWKS98, GGM18]

EK EK EK EK EK EK N [1]32 N [0]32 N [3]32 N [2]32 N [5]32 N [4]32 N [3]32 N [2]32 EK EK T1 (if kl = 128) (if kl = 256) T0 T3 T2 T5 T4 T3 T2 T1 T0 T3 T2 T5 T4 T3 T2 K1 = K2 = K2 =

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 19 / 26

slide-54
SLIDE 54

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

A Better Key Derivation Function

  • security of truncation when dropping m bits: for q large enough,

Advprf

Truncn−m[P](q) ≤

q 2(m+n)/2

  • when dropping m = n/2 bits:
  • two BC calls to obtain an n-bit key
  • security up to 23n/4 queries
  • better construction: XOR of permutations

K1 = EK(N[0]32) ⊕ EK(N[1]32)

  • two BC calls to obtain an n-bit key
  • security up to 2n queries [Pat08, DHT17]
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 20 / 26

slide-55
SLIDE 55

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

A Better Key Derivation Function

  • security of truncation when dropping m bits: for q large enough,

Advprf

Truncn−m[P](q) ≤

q 2(m+n)/2

  • when dropping m = n/2 bits:
  • two BC calls to obtain an n-bit key
  • security up to 23n/4 queries
  • better construction: XOR of permutations

K1 = EK(N[0]32) ⊕ EK(N[1]32)

  • two BC calls to obtain an n-bit key
  • security up to 2n queries [Pat08, DHT17]
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 20 / 26

slide-56
SLIDE 56

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

A Better Key Derivation Function

  • security of truncation when dropping m bits: for q large enough,

Advprf

Truncn−m[P](q) ≤

q 2(m+n)/2

  • when dropping m = n/2 bits:
  • two BC calls to obtain an n-bit key
  • security up to 23n/4 queries
  • better construction: XOR of permutations

K1 = EK(N[0]32) ⊕ EK(N[1]32)

  • two BC calls to obtain an n-bit key
  • security up to 2n queries [Pat08, DHT17]
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 20 / 26

slide-57
SLIDE 57

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

A Better Key Derivation Function

  • security of truncation when dropping m bits: for q large enough,

Advprf

Truncn−m[P](q) ≤

q 2(m+n)/2

  • when dropping m = n/2 bits:
  • two BC calls to obtain an n-bit key
  • security up to 23n/4 queries
  • better construction: XOR of permutations

K1 = EK(N[0]32) ⊕ EK(N[1]32)

  • two BC calls to obtain an n-bit key
  • security up to 2n queries [Pat08, DHT17]
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 20 / 26

slide-58
SLIDE 58

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

A Better Key Derivation Function

  • security of truncation when dropping m bits: for q large enough,

Advprf

Truncn−m[P](q) ≤

q 2(m+n)/2

  • when dropping m = n/2 bits:
  • two BC calls to obtain an n-bit key
  • security up to 23n/4 queries
  • better construction: XOR of permutations

K1 = EK(N[0]32) ⊕ EK(N[1]32)

  • two BC calls to obtain an n-bit key
  • security up to 2n queries [Pat08, DHT17]
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 20 / 26

slide-59
SLIDE 59

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

A Better Key Derivation Function

  • security of truncation when dropping m bits: for q large enough,

Advprf

Truncn−m[P](q) ≤

q 2(m+n)/2

  • when dropping m = n/2 bits:
  • two BC calls to obtain an n-bit key
  • security up to 23n/4 queries
  • better construction: XOR of permutations

K1 = EK(N[0]32) ⊕ EK(N[1]32)

  • two BC calls to obtain an n-bit key
  • security up to 2n queries [Pat08, DHT17]
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 20 / 26

slide-60
SLIDE 60

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

A Better Key Derivation Function

  • security of truncation when dropping m bits: for q large enough,

Advprf

Truncn−m[P](q) ≤

q 2(m+n)/2

  • when dropping m = n/2 bits:
  • two BC calls to obtain an n-bit key
  • security up to 23n/4 queries
  • better construction: XOR of permutations

K1 = EK(N[0]32) ⊕ EK(N[1]32)

  • two BC calls to obtain an n-bit key
  • security up to 2n queries [Pat08, DHT17]
  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 20 / 26

slide-61
SLIDE 61

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Outline

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 21 / 26

slide-62
SLIDE 62

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Concurrent/Subsequent work

  • Gueron and Lindell, Better Bounds for Block Cipher Modes of

Operation via Nonce-Based Key Derivation, CCS 2017

  • security definition puts an upper bound on the number of

decryption queries per nonce → complicated to enforce in practice (stateful decryption)

  • Theorem 6.2 still has problems and can be falsified
  • Bose, Hoang, and Tessaro, Revisiting AES-GCM-SIV: Multi-user

Security, Faster Key Derivation, and Better Bounds, EUROCRYPT 2018

  • shows that the security of AES-GCM-SIV does not degrade in the

multi-user setting

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 22 / 26

slide-63
SLIDE 63

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Concurrent/Subsequent work

  • Gueron and Lindell, Better Bounds for Block Cipher Modes of

Operation via Nonce-Based Key Derivation, CCS 2017

  • security definition puts an upper bound on the number of

decryption queries per nonce → complicated to enforce in practice (stateful decryption)

  • Theorem 6.2 still has problems and can be falsified
  • Bose, Hoang, and Tessaro, Revisiting AES-GCM-SIV: Multi-user

Security, Faster Key Derivation, and Better Bounds, EUROCRYPT 2018

  • shows that the security of AES-GCM-SIV does not degrade in the

multi-user setting

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 22 / 26

slide-64
SLIDE 64

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Concurrent/Subsequent work

  • Gueron and Lindell, Better Bounds for Block Cipher Modes of

Operation via Nonce-Based Key Derivation, CCS 2017

  • security definition puts an upper bound on the number of

decryption queries per nonce → complicated to enforce in practice (stateful decryption)

  • Theorem 6.2 still has problems and can be falsified
  • Bose, Hoang, and Tessaro, Revisiting AES-GCM-SIV: Multi-user

Security, Faster Key Derivation, and Better Bounds, EUROCRYPT 2018

  • shows that the security of AES-GCM-SIV does not degrade in the

multi-user setting

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 22 / 26

slide-65
SLIDE 65

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Concurrent/Subsequent work

  • Gueron and Lindell, Better Bounds for Block Cipher Modes of

Operation via Nonce-Based Key Derivation, CCS 2017

  • security definition puts an upper bound on the number of

decryption queries per nonce → complicated to enforce in practice (stateful decryption)

  • Theorem 6.2 still has problems and can be falsified
  • Bose, Hoang, and Tessaro, Revisiting AES-GCM-SIV: Multi-user

Security, Faster Key Derivation, and Better Bounds, EUROCRYPT 2018

  • shows that the security of AES-GCM-SIV does not degrade in the

multi-user setting

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 22 / 26

slide-66
SLIDE 66

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

Concurrent/Subsequent work

  • Gueron and Lindell, Better Bounds for Block Cipher Modes of

Operation via Nonce-Based Key Derivation, CCS 2017

  • security definition puts an upper bound on the number of

decryption queries per nonce → complicated to enforce in practice (stateful decryption)

  • Theorem 6.2 still has problems and can be falsified
  • Bose, Hoang, and Tessaro, Revisiting AES-GCM-SIV: Multi-user

Security, Faster Key Derivation, and Better Bounds, EUROCRYPT 2018

  • shows that the security of AES-GCM-SIV does not degrade in the

multi-user setting

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 22 / 26

slide-67
SLIDE 67

Background on AES-GCM-SIV Fixing the Security Bound Improving Key Derivation Final Remarks

The end. . .

Thanks for your attention! Comments or questions?

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 23 / 26

slide-68
SLIDE 68

References

References I

Hanno Böck, Aaron Zauner, Sean Devlin, Juraj Somorovsky, and Philipp

  • Jovanovic. Nonce-Disrespecting Adversaries: Practical Forgery Attacks on

GCM in TLS. In USENIX Workshop on Offensive Technologies, WOOT

  • 2016. USENIX Association, 2016.

Wei Dai, Viet Tung Hoang, and Stefano Tessaro. Information-theoretic Indistinguishability via the Chi-squared Method. In Advances in Cryptology

  • CRYPTO 2017 (Proceedings, Part III), volume 10403 of LNCS, pages

497–523. Springer, 2017. Shoni Gilboa, Shay Gueron, and Ben Morris. How Many Queries are Needed to Distinguish a Truncated Random Permutation from a Random Function? J. Cryptology, 31(1):162–171, 2018. Shay Gueron and Yehuda Lindell. GCM-SIV: Full Nonce Misuse-Resistant Authenticated Encryption at Under One Cycle per Byte. In ACM Conference on Computer and Communications Security - CCS 2015, pages 109–119. ACM, 2015.

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 24 / 26

slide-69
SLIDE 69

References

References II

Shay Gueron, Adam Langley, and Yehuda Lindell. AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption. CFGR Draft, 2016. Available at https://tools.ietf.org/html/draft-irtf-cfrg-gcmsiv-05. Shay Gueron, Adam Langley, and Yehuda Lindell. AES-GCM-SIV: Specification and Analysis. IACR Cryptology ePrint Archive, Report 2017/168, 2017. Available at http://eprint.iacr.org/2017/168. Chris Hall, David Wagner, John Kelsey, and Bruce Schneier. Building PRFs from PRPs. In Advances in Cryptology - CRYPTO ’98, volume 1462

  • f LNCS, pages 370–389. Springer, 1998.

Antoine Joux. Authentication Failures in NIST Version of GCM. Comments submitted to NIST Modes of Operation Process, 2006. Available at http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/ comments/800-38_Series-Drafts/GCM/Joux_comments.pdf.

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 25 / 26

slide-70
SLIDE 70

References

References III

David A. McGrew and John Viega. The Security and Performance of the Galois/Counter Mode (GCM) of Operation. In Progress in Cryptology - INDOCRYPT 2004, volume 3348 of LNCS, pages 343–355. Springer, 2004. Jacques Patarin. A Proof of Security in O(2n) for the Xor of Two Random

  • Permutations. In Information Theoretic Security - ICITS 2008, volume

5155 of LNCS, pages 232–248. Springer, 2008. Phillip Rogaway and Thomas Shrimpton. A Provable-Security Treatment

  • f the Key-Wrap Problem. In Advances in Cryptology - EUROCRYPT

2006, volume 4004 of LNCS, pages 373–390. Springer, 2006.

  • T. Iwata and Y. Seurin

Reconsidering AES-GCM-SIV’s Security FSE 2018 26 / 26