[tor-dev] Counter Galois Onion: A New Proposal for Forward-Secure Relay Cryptography

[Tomer Ashur]

Hi Nick, all,

> It would also be interesting to know what the ADL authors think of this proposal too -- most of us at Tor aren't cryptographers ourselves.

We're looking into it. If indeed this proposal delivers on its claims we'll be happy to endorse it over Proposal 295. Will try to get back to you soon. 

Tomer 

-----Original Message-----
From: tor-dev <tor-dev-bounces at lists.torproject.org> On Behalf Of Nick Mathewson
Sent: Sunday, September 15, 2019 3:26 AM
To: tor-dev at lists.torproject.org
Cc: martijn at simula.no
Subject: Re: [tor-dev] Counter Galois Onion: A New Proposal for Forward-Secure Relay Cryptography

On Thu, Sep 12, 2019 at 6:34 PM Jean Paul Degabriele <jpdega at gmail.com> wrote:
>
> Hello tor-devs,
>
> Martijn Stam and myself have previously worked on analysing the 
> security of proposal 261. Together with Martijn's PhD student, 
> Alessandro Melloni, we have now written a proposal for an onion 
> encryption scheme as an alternative to Proposals 261 and 295. It 
> builds on the GCM-RUP construction from [ADL17] but it offers a number 
> of improvements over proposal 295. In addition to addressing the 
> issues described below we expect it to offer better performance. We 
> are currently working on a security proof and potential efficiency 
> optimisations for this scheme. In the meantime, we would be very happy 
> to hear what you think and any feedback you may have. If something is unclear, please let us know.
>

Thank you!  I've added this as proposal 308.  I'll be looking it over with interest in the near future.

One thing that helps me understand this kind of proposal is writing or examining a reference implementation for it, so I can see clearly what state is kept, which party does what, and so on.  I did one for proposal 295 as https://github.com/nmathewson/prop295ref -- I hope I can get a reference implementation together for this one too, unless you're already on it.

It would also be interesting to know what the ADL authors think of this proposal too -- most of us at Tor aren't cryptographers ourselves.

thanks again, and best wishes,
--
Nick
_______________________________________________
tor-dev mailing list
tor-dev at lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev