[tor-dev] Counter Galois Onion: A New Proposal for Forward-Secure Relay Cryptography

[Nick Mathewson]

On Thu, Sep 12, 2019 at 6:34 PM Jean Paul Degabriele <jpdega at gmail.com> wrote:
>
> Hello tor-devs,
>
> Martijn Stam and myself have previously worked on analysing the security
> of proposal 261. Together with Martijn's PhD student, Alessandro Melloni,
> we have now written a proposal for an onion encryption scheme as an
> alternative to Proposals 261 and 295. It builds on the GCM-RUP construction
> from [ADL17] but it offers a number of improvements over proposal 295. In
> addition to addressing the issues described below we expect it to offer better
> performance. We are currently working on a security proof and potential
> efficiency optimisations for this scheme. In the meantime, we would be very
> happy to hear what you think and any feedback you may have. If something
> is unclear, please let us know.
>

Thank you!  I've added this as proposal 308.  I'll be looking it over
with interest in the near future.

One thing that helps me understand this kind of proposal is writing or
examining a reference implementation for it, so I can see clearly what
state is kept, which party does what, and so on.  I did one for
proposal 295 as https://github.com/nmathewson/prop295ref -- I hope I
can get a reference implementation together for this one too, unless
you're already on it.

It would also be interesting to know what the ADL authors think of
this proposal too -- most of us at Tor aren't cryptographers
ourselves.

thanks again, and best wishes,
-- 
Nick