miscreant/meta

FastPRF

tarcieri opened this issue · 5 comments

tarcieri commented

Some interesting ideas in this paper, potentially applicable to PMAC:

Optimal PRFs from Blockcipher Designs

sneves commented

FastPRF cannot help much with PMAC or SIV, since you have a birthday factor endemic to the mode itself. It can help with GCM[-SIV], or more generally counter mode combined with Wegman-Carter, which (with unique nonces) does not have such quadratic factors when used with a PRF. GCM-SIV gets around the birthday factor inherent to SIV-type modes by deriving new keys for each nonce.

tarcieri commented

Thanks for the input! Will go ahead and close this issue out then, as I would personally like to avoid the nonce-specific key derivation as a mandatory step, and it can always be pursued as an optional one.

tarcieri commented

@sneves I'm curious if 1k-PMAC_Plus might address the birthday bound issues:

#76

sneves commented

It does, with respect to the MAC component, but the fundamental issue with SIV remains---collisions in the IV/tag will still happen around the birthday bound, and this will compromise the confidentiality of the mode.

  • 👍1
tarcieri commented

@sneves thanks for the clarification!