On Thu, Sep 12, 2019 at 6:34 PM Jean Paul Degabriele jpdega@gmail.com wrote:
Hello tor-devs,
Martijn Stam and myself have previously worked on analysing the security of proposal 261. Together with Martijn's PhD student, Alessandro Melloni, we have now written a proposal for an onion encryption scheme as an alternative to Proposals 261 and 295. It builds on the GCM-RUP construction from [ADL17] but it offers a number of improvements over proposal 295. In addition to addressing the issues described below we expect it to offer better performance. We are currently working on a security proof and potential efficiency optimisations for this scheme. In the meantime, we would be very happy to hear what you think and any feedback you may have. If something is unclear, please let us know.
Thank you! I've added this as proposal 308. I'll be looking it over with interest in the near future.
One thing that helps me understand this kind of proposal is writing or examining a reference implementation for it, so I can see clearly what state is kept, which party does what, and so on. I did one for proposal 295 as https://github.com/nmathewson/prop295ref -- I hope I can get a reference implementation together for this one too, unless you're already on it.
It would also be interesting to know what the ADL authors think of this proposal too -- most of us at Tor aren't cryptographers ourselves.
thanks again, and best wishes,