Dear authors, thanks for the draft. I have a couple of comments:
- I agree with your answer in previous mail to the list that "nonce/IV MUST be random" is not needed. Indeed, a recommendation is more appropriate, as for a nonce (and AES-GCM-SIV is a nonce-based scheme), it is only important that it is a *n*umber used *once*. - I think renaming the field to "Nonce" may be confusing. The field in IKEv2/ESP context is called IV (for whatever reason) also for other AEAD modes. Then, one constructs a nonce in some way (N := salt || IV, or in what you're suggesting N := IV) for the underlying AEAD algorithm and cryptographic library API. - In Section 6, you seem to have reversed the order in a sentence. You write "... its encryption runs at about two thirds the speed of AES-GCM encryption.". If we're talking about two thirds, then it can only be that AES-GCM encryption has 2/3 the speed of AES-GCM-SIV (since AES-GCM-SIV encryption is a sequential two-pass process). Looking at my personal favorite for AES-GCM(-SIV) benchmarks [1,2], the revised wording roughly holds true for longer messages, if you want to stick to the "two thirds" wording. Cheers, Vukasin Karadzic [1] https://github.com/facebookincubator/haberdashery/blob/main/benchmark_data/md/haberdashery_aes256gcm_skylakex.md [2] https://github.com/facebookincubator/haberdashery/blob/main/benchmark_data/md/haberdashery_aes256gcmsiv_skylakex.md
_______________________________________________ IPsec mailing list -- [email protected] To unsubscribe send an email to [email protected]
