4 ms·
Article doesn't mention that with AES-GCM-SIV you lose indistinguishability - an attacker observing encrypted messages passing by can see when two copies of the
by ivm83 9y ago
Article doesn't mention that with AES-GCM-SIV you lose indistinguishability - an attacker observing encrypted messages passing by can see when two copies of the same message are sent, since they will use the same IV. This might not matter for some cases, but could be a big deal for others.
- stouset 9y agoYes, but only when nonces are reused. In this way, it's at least strictly better than AES-GCM which fails catastrophically. I'm not positive, but I think the GHASH authenticator used might even allow key recovery in this scenario.
- unscaled 9y agoYes. If nonce reuse is expected and distinguishable messages are considered to be a problem, then you really need a larger nonce. AES-GCM-SIV was designed to be nonce misuse resistant while still supporting short nonces. That's why Coda Hale called it a safer footgun. It's much safer, but still a footgun. An AEAD construction based on XChaCha20/XSalsa20-Poly1305 will solve this problem, as would be deriving a per-message key from your master key + a random salt. I'm not an expert, but this seems to me like a safer method if you want to positively eliminate the possibility of nonce reuse, and don't care about the extra overhead from larger nonces and lack of standardization.
- stouset 9y agoNonce reuse is only expected in the sense that cryptographers have begun to accept that developers will always find a way to misuse primitives. That's why these are called "nonce misuse-resistant" ciphers. Cryptographers are not encouraging people to use this type of cipher where nonce reuse is expected. Nonce reuse should never be expected, and always be avoided. But people being people will wrongly use these constructions, so we do our best to try and limit the worst downsides of the footgun. XChaCha20-Poly1305 will not solve this problem, as you seemt o believe. It is more of a footgun, in that it too catastrophically fails under nonce reuse. Yes, it's less likely to suffer reuse in the first place due to a larger nonce size, but that ignores the context driving the creation of SIV schemes: developers who choose nonces poorly, not developers who encrypt too many messages given the likelihood of collision of a random nonce.
- MichaelGG 9y agoShouldn't it have incorporated some random bits or a counter?
- stouset 9y agoThat's what the nonce is. The situation they're referring to happens only when nonces are reused.
- Buge 9y agoIt's not AES-GCM-SIV causing you to lose indisginuishability. Every single other encryption algorithm also loses indisginuishability on nonce reuse.