arktronic / aes-siv Goto Github PK

Hello,

While implementing AES-SIV, I was researching how different implementations handle the case when the plaintext length is zero. I think your implementation got it wrong: when there's no associated data (S0...Sn-1) and the plaintext (Sn) is zero-length, your s2v function returns the CMAC of <one> (in RFC terms), however I think that even zero-length plaintext should be considered as a valid vector, Sn, in s2v, so this case should never be triggered with SIV:

https://github.com/arktronic/aes-siv/blob/9dfa36058b62ee55be35c80da4fa1f35b72ef11e/aes-siv/aes256-siv.cpp#L24:L28

While RFC describes this case:

      S2V(K, S1, ..., Sn) {
        if n = 0 then
          return V = AES-CMAC(K, <one>)
        fi
        ...

having plaintext passed (even if it's empty) to this function makes n always greater than zero.

This is also confirmed by this draft:

http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/siv/siv.pdf

You can see that there's no such case in CMAC*:

What do you think?