On Thu, Oct 7, 2021 at 11:05 PM Stephen Frost <sfr...@snowman.net> wrote: > Sure, I get that. Would be awesome if all these things were clearly > documented somewhere but I've never been able to find it quite as > explicitly laid out as one would like.
:-( > specifically: Appendix C: Tweaks > > Quoting a couple of paragraphs from that appendix: > > """ > In general, if there is information that is available and statically > associated with a plaintext, it is recommended to use that information > as a tweak for the plaintext. Ideally, the non-secret tweak associated > with a plaintext is associated only with that plaintext. > > Extensive tweaking means that fewer plaintexts are encrypted under any > given tweak. This corresponds, in the security model that is described > in [1], to fewer queries to the target instance of the encryption. > """ > > The gist of this being- the more diverse the tweaking being used, the > better. That's where I was going with my "limit the risk" comment. If > we can make the tweak vary more for a given encryption invokation, > that's going to be better, pretty much by definition, and as explained > in publications by NIST. I mean I don't have anything against that appendix, but I think we need to understand - with confidence - what the expectations are specifically around XTS, and that appendix seems much more general than that. -- Robert Haas EDB: http://www.enterprisedb.com
