SIV-MAC: An Efficient MAC Scheme

SIV-MAC is a deterministic Message Authentication Code (MAC) built over the efficient universal family of hash functions POLYVAL. Unlike the standardized GMAC that also uses universal hashing (with GHASH) SIV-MAC does not require a nonce. SIV-MAC is the special case of the nonce-misuse resistant AEAD named AES-GCM-SIV, instantiated with a 256-bit main key and a fixed 96-bit zero nonce. The authentication tag of a string X is the output of AES-GCM-SIV invoked with an empty message and with X as the Additional Authenticated Data (AAD). This means that SIV-MAC is readily available in libraries that support AES-GCM-SIV, such as BoringSSL and OpenSSL (The OpenSSL Project, OpenSSL: the open source toolkit for SSL/TLS. www.openssl.org , 2003). However, performance can be further improved. We show here how tagging messages can reach asymptotic performance of  0.3 cycles per byte. Finally, we explain why a key can be used for safely processing  250 bytes before it needs to be rotated.