I would like to know what the standard is for two-pass, nonce-misuse-resistant AEAD that is efficient in software. Thus, AES-SIV is excluded; modes based on a stream cipher like ChaCha20 are preferred.
$\begingroup$
$\endgroup$
1
-
$\begingroup$ AES-SIV is the standard $\endgroup$– Richie FrameCommented Feb 22, 2016 at 2:46
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
AES-SIV when done well can be very fast. If you have AES-NI then it is possible to get under a cycle per byte. It is not the original AES-SIV construction but rather this one based on GCM (I agree that the original AES-SIV is way too slow). I suggest also that you look at the Caesar candidates. In general, there is no "standard" yet here.
answered Feb 21, 2016 at 21:27
-
$\begingroup$ If I am running on a CPU that doesn't have hardware support for AES and GHASH, this mode doesn't sound very attractive. Can one create a similar construction based on ChaCha20 and Poly1305? $\endgroup$– DemiCommented Feb 22, 2016 at 3:20
-
$\begingroup$ Yes. If you look at the paper, then it actually gives a generic nonce-misuse resistant construction (see Section 2). You can instantiate it with ANY PRF (which is fine for most MACs) and any secure nonce-based encryption scheme. $\endgroup$ Commented Feb 22, 2016 at 12:44