Can I use MAC as CTR mode nonce, if my messages are non-repeating?

Question

I design encryption for a network protocol with restrictively low MTU. I'm aiming at 128 bit strength; AES-128-CCM would add 128 nonce bits and 128 MAC bits to each packet. Such MTU reduction by 32 bytes is not acceptable and I must come up with a solution which adds smaller overhead.

The protocol messages do not repeat between re-keying, because they contain large enough sequence number (I can specify how often to re-key).

Question: Can I use the packet MAC as the nonce for the CTR mode encryption?

AFAIK the only requirement for the "counter" value is that it does not repeat for the same key, and that is guaranteed by message uniqueness (assuming MACs would not collide). Such "reuse" would save me 16 nonce bytes in each packet.

Answer 1

Yes, but to use a known algorithm that specifies precisely that, take a look at the SIV mode of operation . "SIV" stands for Synthetic IV. IV is the initialization vector, which is the nonce (or the nonce and initial counter value, depending on the definitions).

---

Unsurprisingly SIV relies on CTR mode for confidentiality and CMAC for the authentication tag that doubles as IV - much like CCM (which relies on secure usage of CBC-MAC, the underlying mode that CMAC uses).

The problem with CCM is that you would have a chicken/egg problem as the MAC is calculated at the end of the protocol. This means that it would not work well as a SIV mode. Although you could implement the protocol differently, I'd recommend to use a tried and tested mode instead. CCM mode is - at least in my opinion - not a nice mode to use when it comes to the configuration and implementation details.

---

SIV does have the problem that it is a full two pass protocol; you will have to go over each packet twice to encrypt: one pass for creating the SIV and on pass to encrypt. Decryption is easier as you already have the IV ready, so you can at least combine the two passes.

Addendum: There is also AES-GCM-SIV, which is considered a 1.5 pass protocol, in the sense that GMAC is usually faster - depending on the processor capabilities. It could be used where the speed of the protocol is more important than strength of the MAC construction.