3 ms·
Yes. If nonce reuse is expected and distinguishable messages are considered to be a problem, then you really need a larger nonce. AES-GCM-SIV was designed to be
by unscaled 9y ago
Yes. If nonce reuse is expected and distinguishable messages are considered to be a problem, then you really need a larger nonce. AES-GCM-SIV was designed to be nonce misuse resistant while still supporting short nonces. That's why Coda Hale called it a safer footgun. It's much safer, but still a footgun.
An AEAD construction based on XChaCha20/XSalsa20-Poly1305 will solve this problem, as would be deriving a per-message key from your master key + a random salt. I'm not an expert, but this seems to me like a safer method if you want to positively eliminate the possibility of nonce reuse, and don't care about the extra overhead from larger nonces and lack of standardization.
- stouset 9y agoNonce reuse is only expected in the sense that cryptographers have begun to accept that developers will always find a way to misuse primitives. That's why these are called "nonce misuse-resistant" ciphers. Cryptographers are not encouraging people to use this type of cipher where nonce reuse is expected. Nonce reuse should never be expected, and always be avoided. But people being people will wrongly use these constructions, so we do our best to try and limit the worst downsides of the footgun. XChaCha20-Poly1305 will not solve this problem, as you seemt o believe. It is more of a footgun, in that it too catastrophically fails under nonce reuse. Yes, it's less likely to suffer reuse in the first place due to a larger nonce size, but that ignores the context driving the creation of SIV schemes: developers who choose nonces poorly, not developers who encrypt too many messages given the likelihood of collision of a random nonce.