Subject: [saag] NIST Leightweight Crypto report

From: Robert Moskowitz <[email-masked]>
Date: Tue, 27 Jul 2021 11:05:19 -0400

NIST just came out with:  NISTIR 8369

"Status Report on the Second Round of the NIST Lightweight Cryptography 
Standardization Process"

https://csrc.nist.gov/publications/detail/nistir/8369/final

I have been working with Xoodyak which is one of the 4 AEAD/hashing 
finalists.  You can see how I am using it in:

https://datatracker.ietf.org/doc/draft-moskowitz-hip-new-crypto/

I "like" Xoodyak, as I am able to use it much like Keccak/SHA3/SHAKE.  
It does not come with the nice standardized calls as in SP800-185, but I 
think I have duplicated SHAKE/cSHAKE/KMAC with Xoodyak in my draft.  
Comments welcome!

It has been implemented in openHIP.

Bob

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Tue, 27 Jul 2021 15:21:38 +0000

I have no comment, but one question: which of the NIST Lightweight Crypto candidates provide nonce misuse resistance, at least at the level comparable with SIV mode?

--
Regards,
Uri
 
There are two ways to design a system. One is to make is so simple there are obviously no deficiencies.
The other is to make it so complex there are no obvious deficiencies.
                                                                                                                                     -  C. A. R. Hoare

On 7/27/21, 11:06, "CFRG on behalf of Robert Moskowitz" <[email-masked] on behalf of [email-masked]> wrote:

    Bob

    _______________________________________________
    CFRG mailing list
    [email-masked]
    https://www.irtf.org/mailman/listinfo/cfrg

---

From: Thomas Peyrin <[email-masked]>
Date: Tue, 27 Jul 2021 23:01:02 +0200

Dear Uri,

(full disclosure: I am one of the designers of Romulus)

Among the finalists, I believe only Romulus has a version (Romulus-M) that
is nonce-misuse resistant, similarly to SIV. Note also that Romulus now
includes hashing feature as well (Romulus-H).

Regards,

Thomas.

Le mar. 27 juil. 2021 à 17:22, Blumenthal, Uri - 0553 - MITLL <
[email-masked]> a écrit :

> I have no comment, but one question: which of the NIST Lightweight Crypto
> candidates provide nonce misuse resistance, at least at the level
> comparable with SIV mode?
>
> --
> Regards,
> Uri
>
> On 7/27/21, 11:06, "CFRG on behalf of Robert Moskowitz" <
> [email-masked] on behalf of [email-masked]> wrote:
>

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Wed, 28 Jul 2021 00:57:58 +0000

Dear Uri,

That is fine. ;-)

Among the finalists, I believe only Romulus has a version (Romulus-M) that is nonce-misuse resistant, similarly to SIV. Note also that Romulus now includes hashing feature as well (Romulus-H).

Thank you!

Let me look into Romulus, and I may have specific questions for you that I’ll ask offline.

Thanks

Le mar. 27 juil. 2021 à 17:22, Blumenthal, Uri - 0553 - MITLL <[email-masked]> a écrit :

--
Regards,
Uri

    Bob

---

From: Matt Sicker <[email-masked]>
Date: Tue, 27 Jul 2021 11:12:24 -0500

Also a fan of Xoodyak here. I ported some of the LWC algorithms to
Java as an experiment back during the first or second round, and my
top choices were Xoodyak for its super useful Cyclist mode along with
Ascon for speed and simplicity (and ISAP looked promising, but it's
essentially a different mode of operation on Keccak or Ascon
permutations). Really, all the sponge function algorithms have a ton
of promise for improving the developer experience of actually using
cryptography in practice.