NIST, Computer Security Division, Computer Security Resource Center
Public Comments
Comments on the Draft GCM Specifications
The following public comments were submitted on the second (July, 2007) draft NIST SP 800-38D: Recomendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC :
Commenter
The following paper was submitted as a public comment on the first (April, 2006) draft NIST SP 800-38D: Recomendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM):
Authentication Failures in NIST version of GCM - Antoine Joux
Other comments that NIST received on the draft are available in PDF here.
Comments on the Choice Between CWC or GCM
NIST requested public comments on its intention to recommend either the CWC mode or the GCM mode. Links to PDF files of papers that were submitted are given in the following list:
- Authentication Weaknesses in GCM - Niels Ferguson
- A High Speed Architecture for Galois/Counter Mode of Operation (GCM) - Bo Yang, Sambit Mishra, Ramesh Karri
- GCM Update - David McGrew, John Viega
- Multiple forgery attacks against Message Authentication Codes - David McGrew, Scott R. Fluhrer
- Comments on CWC and GCM Modes for Authenticated Encryption - Dana Neustadter, Michael Bowler, Tom St. Denis, Mike Borza
Other public comments on the draft are available in PDF here. The comment period ended June 1, 2005.
Comments on the Draft CMAC Specification
The public comments on the draft NIST Special Publication 800-38B, Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication are collected here.
Comments on the Draft CCM Specification
Links to PDF files of papers that were submitted as public comments on the draft NIST Special Publication 800-38C, Recommendation for Block Cipher Modes of Operation: The CCM Mode for Authentication and Confidentiality are given in the table below:
- A Critique of CCM - Phillip Rogaway, David Wagner
- Comments on NIST Draft Pub 800-38C: CCM mode of operation - Rene Struik
Other public comments on the draft, submitted within email messages, are available in PDF here.
Another document briefly describes NIST's responses to the most significant public comments.
Comments on Draft RMAC Specification
Links to PDF files of papers that were submitted as public comments on the early draft of NIST Special Publication 800-38B, Recommendation for Block Cipher Modes of Operation: The RMAC Authentication Mode are given in the table below. NIST subsequently decided to replace RMAC with CMAC.
- An Analysis of RMAC - Jack Lloyd
- Analysis of RMAC - Lars R. Knudsen
- Comments on NIST's RMAC Proposal - Phillip Rogaway
- Related-Key and Key-Collision Attacks Against RMAC - Tadayoshi Kohno
- Comments on the security of RMAC as proposed in NIST Draft 800-38B - Éliane Jaulmes, Antoine Joux, and Frédéric Valette
- Comments on RMAC - David Wagner
- Comments on the RMAC algorithm - John Black
- Comparison of CBC MAC Variants and Comments on NIST's Consultation Paper - Tetsu Iwata
Other public comments on the draft, submitted within email messages, are available in PDF here.
General Public Comments on Modes
The general public comments on modes of operation that were submitted within email messages are available in two PDF files:
- comments submitted before the first modes workshop
- ongoing comments (updated periodically).
Links to PDF files of the papers on modes of operation that were submitted as public comments are given in the table below:
- Galois MAC with forgery probability close to ideal - Kaisa Nyberg, Henri Gilbert, Matt Robshaw
- Collision attacks on OCB - Niels Ferguson
- Cryptographic Modes of Operation for the Internet - Steven M. Bellovin, Matt Blaze
- Stronger Security Bounds for OMAC, TMAC and XCBC - Tetsu Iwata
- On the security of XCBC, TMAC and OMAC - Chris J. Mitchell
- On the Security of Two New OMAC Variants - Tetsu Iwata and Kaoru Kurosawa
- Correction to "On the Security of Two New OMAC Variants" - Tetsu Iwata and Kaoru Kurosawa
- Comments on "On the security of XCBC, TMAC and OMAC" by Mitchell - Tetsu Iwata
NIST continues to accept public comments on modes of operation, including comments on:
- Properties of individual modes (security, performance, etc.)
- Comparisons of proposed modes
- Recommendations for standardization
- Other related issues, such as padding
Comments may be submitted to EncryptionModes@nist.gov.