1
$\begingroup$

I'm trying to wrap my head around the concept of SIV in the context of encryption. I understand the aspect of nonce misuse, etc. And I understand that the key feature for SIV is that they ensure that while encrypting the same message with the same key will reveal that it is identical, it will not reveal anything else.

In particular, using the same key on different messages will not have the catastrophic issue with nonce reuse in other system.

If I understand correctly, you can build a SIV mode of operation using:

def encrypt(msg, key):
   siv = hash_shake256(bits=192, msg)
   return xchacha20(key, siv, msg), siv

In other words, we first compute a keyed hash on the message, then use that value as the nonce for the actual encryption.

The output is the cipher text as well as the generated siv, both of them are safe to share without revealing anything to an adversary.

The security comes from the keyed hash function non reversible nature and the fact that for each msg we pass as input, we are ensured that we won't have a duplicate nonce.

  • Am I understanding things correctly?
  • Is it safe to use the same key for both keyed hash and encryption?
  • I assume actual siv usage is a bit more than just hashing the input?
Improve this question
$\endgroup$
7
  • 1
    $\begingroup$ There is already HS1-SIV; Advantages of HS1-SIV over ChaCha20-Poly1305-SIV? also Would it be safe to use the message hash as the IV in ChaCha? $\endgroup$
    – kelalaka
    Commented Oct 22, 2021 at 9:35
  • $\begingroup$ I've seen a SIV mode for ChaCha, however, I couldn't find the paper. $\endgroup$
    – kelalaka
    Commented Oct 22, 2021 at 10:06
  • 1
    $\begingroup$ What I don't understand from the question is that hash_shake256 is used over just the message, but that you talk about "security comes from the keyed hash function". SHAKE256 is not a keyed hash function at all, you'd use e.g. KMAC for that (this is basically the same as SHA-256 vs HMAC-SHA-256). $\endgroup$
    – Maarten Bodewes ♦
    Commented Oct 22, 2021 at 14:46
  • $\begingroup$ Note that HS1-SIV does use a keyed hash function, and that it actually XOR's the result of that with the key before encryption. Yes, just using a plain hash is a bad idea. Anybody may know the hash, and anybody may know the ciphertext. That means that you can just flip bits in the hash output and message to get a valid result. It is absolutely required that you'd use a keyed hash. $\endgroup$
    – Maarten Bodewes ♦
    Commented Oct 22, 2021 at 14:52
  • 1
    $\begingroup$ @kelalaka eprint.iacr.org/2020/067 may have been the paper you saw. $\endgroup$
    – SAI Peregrinus
    Commented Oct 22, 2021 at 17:08

1 Answer 1

Reset to default
1
$\begingroup$

Am I understanding things correctly?

SIV requires MAC, not just hash. Keyed hash can be used as MAC. However, you do not have a keyed hash in your example (but you do say keyed hash).

Is it safe to use the same key for both keyed hash and encryption?

Generally different key should be used for MAC and encryption. Although in some cases it may be fine with same key, if MAC and encryption are different enough. For example, if you use CBC-MAC and CTR both with AES, using same key is bad. SIV mode defines how you derive the keys from master key.

I assume actual siv usage is a bit more than just hashing the input?

Well, again you have to use MAC. You should check actual SIV variant for more details. For example SIV with AES (CMAC and CTR): https://datatracker.ietf.org/doc/html/rfc5297

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.