Obviously SIV is reviewed by people much more familiar with cryptanalysis than I am, but I am not sure how an IV based upon a hash of the message contents is any less likely to collide than an IV that is randomly generated?
Isn't the ideal case for a hash that two different inputs will generate outputs exactly as likely to collide as two random numbers?
[edit]
I found the RFC[1] and it explains it. In SIV mode, the inputs are a (Key, Nonce) just like AES-GCM, but the keys used internally are generated deterministically from the key and nonce, so that each nonce provided uses a different key for the AES primitive, and then uses a synthetically generated (from plaintext) IV as input to AES.
SIV-type schemes use the message content to guard against accidental message IV duplication, which can occur for numerous reasons including bad random sources, loss of storage, or just a smaller IV. They use the message content and message IV to generate a synthetic IV that is message-dependent so a duplicated message IV has no effect (other than revealing message duplication if the messages happen to also be the same).
Comments
Obviously SIV is reviewed by people much more familiar with cryptanalysis than I am, but I am not sure how an IV based upon a hash of the message contents is any less likely to collide than an IV that is randomly generated?
Isn't the ideal case for a hash that two different inputs will generate outputs exactly as likely to collide as two random numbers?
[edit]
I found the RFC[1] and it explains it. In SIV mode, the inputs are a (Key, Nonce) just like AES-GCM, but the keys used internally are generated deterministically from the key and nonce, so that each nonce provided uses a different key for the AES primitive, and then uses a synthetically generated (from plaintext) IV as input to AES.
1: https://tools.ietf.org/html/draft-irtf-cfrg-gcmsiv-05
SIV-type schemes use the message content to guard against accidental message IV duplication, which can occur for numerous reasons including bad random sources, loss of storage, or just a smaller IV. They use the message content and message IV to generate a synthetic IV that is message-dependent so a duplicated message IV has no effect (other than revealing message duplication if the messages happen to also be the same).