Should NIST Develop an Additional Version of GCM? July 26, 2007 Morris Dworkin, Mathematician Security Technology Group

Some of the Submissions to NIST for Authenticated Encryption Patented, One-Pass, Parallelizable Modes —XECB, etc.Gligor, Donescu —IAPMJutla —OCBRogaway Other Parallelizable Modes, One-Pass + Universal Hash —GCMMcGrew, Viega —CWCKohno, Viega, Whiting Two-Pass Modes —CCMHousley, Whiting, Ferguson —EAXBellare, Rogaway, Wagner

Galois/Counter Mode (GCM) Designed, analyzed, submitted by McGrew & Viega Authenticated encryption with associated data (AEAD) —Counter mode encryption using approved block cipher —Authentication using universal hash function in Galois field —Requires 96-bit initialization vectors (IVs) that do not repeat for the life of the key Performance —High-speed (10Gbit/sec) hardware implementation —Good in software, given table lookups

GCM Authenticated Encryption P C A GHASH H 0v0v 0u0u [len(A)] 64 [len(C)] 64 IV inc CIPH K T GCTR K MSB t H J0J

GCM Authenticated Decryption P CA GHASH H 0v0v 0u0u [len(A)] 64 [len(C)] 64 IV inc CIPH K GCTR K MSB t H J0J0 T T if  FAIL

GCM GCTR Function

GHASH Function (NIST version, w/o length encodings) In effect, the GHASH function calculates X 1  H m  X 2  H m-1 ...  X m-1  H 2  X m  H.

Summary of the Development of NIST Special Publication D Announcement of selection of GCM over CWC (2005) First draft SP D (spring of 2006) —Restricts range of tag lengths to bytes Joux’s public comment (June, 2006) —Practical attack if initialization vector (IV) is repeated for a key —Suggests design modifications Second draft SP D (July, 2007) —Elaborates on IV requirements —Removes support for variable-length IVs

Joux’s Attack on Repeating IVs Assumes IVs are repeated for distinct encryption inputs —Violation of GCM requirements (implementation error) —Adversary needs only a couple of pairs of IV-sharing ciphertexts Adversary can probably derive authentication subkey If so, authentication assurance is essentially lost —Valid tags can be found for arbitrary ciphertext, reusing old IV —Counter mode “malleability” can be exploited Given one known plaintext-ciphertext pair, and reusing its IV, adversary can choose any bits to “flip” Confidentiality apparently not affected

Elaboration on IV Requirements in Second Draft NIST SP D Two IV constructions —Deterministic assurance of uniqueness —Random bit generator, up to threshold of over life of key Implementation considerations for designer and implementer —E.g., recovery from power loss For validation against FIPS —IV generation must be within cryptographic boundary of module —IV is a critical security parameter until invoked (for encryption) —Documentation requirements

Develop a “Misuse Resistant” Variant? Joux suggests modifications NIST would like feedback on whether to develop a variant of GCM that resists Joux’s attack Pros —Allow relaxation of IV validation —Increase general purpose usability Cons —Reduce performance, especially in hardware —Algorithm proliferation NIST intends to finalize the original spec independently

P C A GHASH 0v0v 0u0u [len(A)] 64 [len(C)] 64 IV inc T GCTR MSB t J0J0 Joux’s Suggested Modifications to GCM Authenticated Encryption GCTR CIPH K H Strong KDF K K1K1K2K2K3K3K4K4 K3K3 K2K2K1K1 K4K4 CIPH

Hardware Performance (bits/cycle) Assuming Single AES Pipeline Bytes GCM CWC OCB Bytes IPI GCM CWC OCB

Internet Performance Index (IPI) Table taken from “The Security and Performance of the Galois/Counter Mode (GCM) of Operation (Full Version)” Packet distribution f(s)=the expected fraction of bytes that are carried in packets of size s. Using data from paper of Claffy, Miller Thompson (1998): f(1500)=0.6, f(576)=0.2, f(552)=0.15, f(44)=0.05 IPI=the expected number of bits processed per clock cycle for this packet distribution. “Useful indicator of the performance of a crypto module that protects IP traffic using e.g. ESP in tunnel mode…”

GCM in Hardware: No Stalls in the AES Pipeline …P4P3P2P1T TP2P1 R1R2R3R4R5R6R7R8R9R10 The grey message has three counter blocks to encrypt: two for its plaintext blocks, and one for the output of the GHASH function. The counter blocks for the one-block yellow message and the multi-block blue message follow directly in the pipeline.

Software Performance Comparison (Mbps on 1 GHz processor) Bytes GCM 64K GCM 4K GCM 256 OCBCWCEAXCCM CBC- HMAC IPI

Comments ?