NIST request for pre-draft comments on SP 800-38D

[Dworkin, Morris J. (Fed)]

FYI, on Monday NIST posted a request for public comments on the pending revision of SP 800-38D, especially on the development of a wide variant of Galois/Counter Mode, to support the eventual standardization of a 256-bit block cipher. Public comments were requested by July 31.

 

Morris Dworkin

on behalf of the NIST cipher modes team

[John Preuß Mattsson]

Hi Morris,

Ericsson provided the following comments
https://emanjon.github.io/NIST-comments/2026%20SP%20800-38D.pdf

John Preuß Mattsson
Expert Cryptographic Algorithms and Security Protocols, Ericsson

on behalf of the Ericsson Cryptography Team

[Jean Paul Degabriele]

Hi All,

Please find attached our comments regarding the design of wide-GHASH to be included as part of wGCM. Please let us know if further technical details, implementation results, or clarifications would be useful.

Best regards,

Jean Paul Degabriele, Jan Gilcher, Jérôme Govinden and Kenneth G. Paterson

[John Preuß Mattsson]

Hi all,

Jean and team, thanks for sharing. Looking forward to read [DGGP26] when published.

My colleague Alexander Maximov and I continued to think a lot about suitable polynomial hash function for Rijndael-256 and also implemented and benchmarked a lot of potential alternatives.

- We no longer believe in 1x^191 + x^120 + 1 and similar trinomials are the best choice, due to complications with data alignment, impacting software performance.
- We also implemented a (2^64)^3 tower field but it showed no speed gain versus a classical 2^192 field.
- Our current thinking is that the best wide GHASH field is GF(2^192) with the polynomial x^192 + x^7 + x^2 + x + 1 (x^192 + x^191 + x^190 + x^185 + 1 for POLYVAL style, POLYVAL-192). 192 aligns with the (64x64)-bit carry-less multiplier in PCLMULQDQ and PMULL.
- GF(2^256) with x^256 + x^10 + x^5 + x^2 + 1 is significantly slower and we do not see any practical need for such a large field.
- In a few weeks we will add Rijndael-256 with POLYVAL-192 to draft-mattsson-cfrg-aes-gcm-sst and resubmit that as draft-mattsson-cfrg-gcm-sst as it is no longer just AES.

Cheers,
John Preuß Mattsson

[Roberto Avanzi]

Hello

I have two comments and a question

1.

I would use the name MHASH for the "POLYVAL"-like function, where MHASH stands for Montgomery Hash.  It is not a new function, just GHASH computed in a different representation of the field, and it would be fitting to place the name of Montgomery, that first proposed that representation for computational purposes.

2.

For processing data in 256-bit chunks through the AXU, we could use

the primitive polynomial  p(X) = X^256 + X^254 + X^251 + X^246 + 1.

p', the inverse of p(X) modulo X^256 is X^254 + X^251 + X^246 + 1 .

I already proposed this polynomial in a paper.

For 192-bit security, p(x) = x^192 + x^191 + x^190 + x^185 + 1 is fine,

and its p' is also equal to its residue: p'(x) = x^191 + x^190 + x^185 + 1 .

3.

have you tried for your 192-bit code the short convolution with 6

multiplications?

  (a_2 Y^2 + a_1 Y + a_0)  (b_2 Y^2 + b_1 Y + b_0)
          =  a_2  b_2  Y^4 +
          + ((a_2 + a_1)  (b_2 + b_1) - a_1  b_1 - a_2  b_2)   Y^3 +
          + ((a_2 + a_0)  (b_2 + b_0) - a_0  b_0 + a_1  b_1 - a_2  b_2)   Y^2 +
          + ((a_1 + a_0)  (b_1 + b_0) - a_0  b_0 - a_1  b_1 )   Y

          + a_0  b_0

Y would be = x^64 and all a_i, b_i polynomials of degree up to 63.

 Roberto Avanzi