Re:AES-Gem (AES with Galois Extended Mode)
by jedisct1 on Saturday July 13, 2024 @03:15PM
(#40956171)
This is a great proposal.
It would have been a good opportunity to leverage the AES-PRF construction (see tosc.v2018.i2.161-191 in addition to the original paper), whose overhead is negligible. But unfortunately, FIPS restrictions is why we can't have nice things.
If FIPS compliance is not a requirement, AEGIS (AEGIS-256 in particular) is a more efficient alternative and on the standard track.
But when only FIPS-approved things can be used, AES-GEM is a nice way to solve a very common problem.
It would have been a good opportunity to leverage the AES-PRF construction (see tosc.v2018.i2.161-191 in addition to the original paper), whose overhead is negligible. But unfortunately, FIPS restrictions is why we can't have nice things.
If FIPS compliance is not a requirement, AEGIS (AEGIS-256 in particular) is a more efficient alternative and on the standard track.
But when only FIPS-approved things can be used, AES-GEM is a nice way to solve a very common problem.