Re: GCM / seqiv and SP800-38D

Am Samstag, 28. Februar 2015, 23:47:12 schrieb Herbert Xu:

Hi Herbert,

On Thu, Feb 19, 2015 at 07:56:48AM +0100, Stephan Mueller wrote:

quoted

In case of rfc4106(gcm(aes)), the IV is 96 bits. Thus, our constructed

quoted

IV looks like:

The IV to rfc4106 is 96 bits, but the IV to the underlying gcm
is 128 bits so that's what guarantees the uniqueness.

We have to be careful with the wording here: SP800-38D specifies the 96 bits 
as the IV (also called the nonce). The additional 32 bit you refer to is the 
counter for the CTR mode. The complete 128 bit are *not* referred to when 
SP800-38D speaks about the uniqueness of IVs in section 8.2.1 or 8.2.2.

Thus, we come back to the 96 bits. And I do not dispute that there is almost 
zip probability of collisions, all I want to state is that the construction 
method with seqiv does neither comply with section 8.2.1 nor with 8.2.2. That 
means, the GCM IV construction currently does not meet the specification of 
SP800-38D. Furthermore, the authors of SP800-38D currently do not approve of 
the seqiv construction method.

-- 
Ciao
Stephan