# Tag Info

12

The definition of DAE security, as given in Rogaway and Shrimpton's original paper (which both defines the security notion and proves that SIV mode satisfies it), does effectively require that a DAE scheme must protect ciphertext integrity. Specifically, the definition of DAE security (definition 1 in the paper) says that an encryption scheme is DAE secure ...

8

You can safely use HMAC-SHA256 instead of the SIV mode custom PRF to derive the nonce/authentication tag. There's some caveats: HMAC-SHA256 gives a 256-bit output; you'll have to truncate it to the nonce size. HMAC-SHA256 takes in a single bit string, so it can't distinguish the boundary between a header (unencrypted associated data) and payload (encrypted ...

8

Skimming these three papers should give you an idea (which I list roughly in the order I recommend you look at them): Rogaway, Philip. 2004. "Nonce-based symmetric encryption." Namprempre, Chanathip, Phillip Rogaway and Thomas Shrimpton. 2014. "Reconsidering Generic Composition." Bellare, Mihir and Chanathip Namprempre. 2000. "Authenticated Encryption:...

8

The synthesized IV does not need to be random. AES-SIV is a deterministic authenticated encryption mode: it can be used without any nonce when it is not a concern if the attacker can tell that the same message is being transmitted (under the same key) multiple times. Privacy and authentication are still guaranteed. SIV recommends to use a nonce (more ...

6

No, AES-SIV is just newer. There are currently no published weaknesses (to my knowledge). There are however a few practical inefficiencies: the fixed locations of the SIV (/ authentication tag) can be a bit tricky to work with, as it means that the wrapped key data cannot be stored in the same place as the unwrapped key data; it's a two pass protocol, ...

6

The point of the IV is to prevent the same (key,IV) from ever being used for two different messages in practice. This is an absolute requirement for stream ciphers or block cipher modes such as CTR that are effectively stream ciphers, because re-using the same (key,IV) pair lets an eavesdropper trivially obtain the XOR of two plaintext messages, which means ...

5

ChaCha20-Poly1305-SIV is not well defined, and does not have the advantages of SIV-mode if you do define it. The SIV mode is essentially MAC-then-encrypt, with the MAC reused as nonce. The MAC in ChaCha20-Poly1305 requires a nonce, because it uses ChaCha20 to encrypt the Poly1305 authenticator (you cannot reveal the raw authenticator). So you cannot use it ...

4

SIV is considered determanistic authenticated encryption because: It is deterministic; given a key, a plaintext maps to a specific ciphertext; there is no randomness involved. It is authenticated encryption; it provides privacy (that is, someone with a set of ciphertexts but without the key gets no information about the plaintexts, other than its length, ...

4

Correctly implemented, it should be secure deterministic authenticated encryption. In fact, it is SIV, in the wider sense of using the "SIV construction" as defined in Deterministic Authenticated-Encryption by Rogaway and Shrimpton (except for lacking a header input). The proof of the security of the SIV construction is that: We will now show that if $F$ ...

3

I don't think it will become popular. AES-SIV has a main usage as key wrapping mechanism for its deterministic encryption properties. But keys are generally pretty small; parallel computation is certainly not required for minimal amounts of data. With regards of performance: yes it can be parallelized. But on a modern machine you may need a lot of ...

3

Do I have to do all the "zero" stuff and doubling and XORing? If you are implementing the S2V primitive, using an AES-CMAC function, then yes, you will need to do all that "zero" stuff and doubling and XORing. Yes, if you peek inside the AES-CMAC function, you will find some logic that looks sort of like this; processing an all zero block, doubling the ...

2

Short answer: AEAD is completely the wrong tool for the job. You need a MAC, or perhaps a hash. Here are two important facts about cryptography: Details matter. You can't just take a good, secure construction and modify it and expect it to remain secure. Cryptography is not limited to encryption. from my side because i dont need to decrypt the ciphertext ...

2

The SIV that you describe is the way that it is often specified specifically for key wrap. However, you always want to have an IV since encryption of the same message twice should yield different ciphertexts. If you only derive the IV from the message and key, then it will always be the same for the same message. By deriving the effective IV from the input ...

2

Taking the hash of the message as IV would not be secure, since, like Ricky Demer mentioned in comments, it would make the hash public and allow guessing. However, that is not what SIV mode does – it uses a MAC as IV. Doing that with ECIES would be possible, but probably not a good idea: Normal ECIES has single-use symmetric keys, so it requires no IVs. ...

2

Rogways's paper on the algorithm goes deeper into detail: http://web.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf and discusses more about design rationale and provides proof (more than the RFC). I find a lot of benefits in SIV and S2V. For me, the most important is that it can be used without nonce. The second most important is that the mode builds on widely ...

2

There has been work on this. I recommend reading the paper Nonce-Based Cryptography: Retaining Security when Randomness Fails and the references therein. In particular, references [5,9,33] within refer to "hedged public-key encryption" which maintains security as long as the entropy of the message together with the randomness is high enough (you can't really ...

2

Both require random elements for security, and it seems to me that both would not achieve semantic security (IND-CPA) if these repeat as RSA is otherwise deterministic. Actually, that would be true of any potentially misuse resistant system. As long as you don't fold in fresh randomness, and as long as you don't update long term state during the encryption,...

2

With SIV it is not required to use a nonce at all. That is: the uniqueness that is required to make the deterministic SIV scheme secure must reside in the plaintext or additional authenticated data. From this uniqueness an authentication tag is constructed that doubles as authentication tag (which is required to have similar properties). This makes it ...

2

The main advantage of SIV over modes that came before it is its better resistance to nonce reuse1. While using the same nonce it becomes deterministic (allowing an attacker to see if two messages are equal), but otherwise retains its security – including the security of authentication which in many other systems is lost completely. E.g. AES-GCM ...

1

Yes, deterministic encryption would be a good solution to the problem you outlined. Do however note, that an analytics service for credit card transactions will probably get information about payments like the time, location and amount. This can easily be used to create a profile for a specific ID. Given some extra information, for example from marketing ...

1

Both: Secure deterministic encryption for one-block messages. ECB: No expansion for block-sized messages. Faster. SIV: Authentication. Works for messages of any size.

Only top voted, non community-wiki answers of a minimum length are eligible