aessiv

AESSIV, or AES-SIV, is a mode of operation for the AES block cipher that provides authenticated encryption with associated data (AEAD). It is deterministic and does not require a random nonce, distinguishing it from many other AEAD schemes that rely on nonce generation.

The algorithm uses two AES keys. A synthetic IV T is computed as CMAC_K2 over the associated data and the plaintext: T = CMAC_K2( AAD1 || AAD2 || ... || AADn || P ). The plaintext P is then encrypted with AES-CTR using key K1 and IV = T to produce the ciphertext C. The final output is the tag T followed by C. For decryption, the receiver reads T, decrypts C with AES-CTR under K1 and IV = T to recover P, then recomputes T' = CMAC_K2( AAD1 || AAD2 || ... || AADn || P ) and accepts only if T' equals T.

Security and properties: AES-SIV provides confidentiality and integrity as an AEAD scheme. It is deterministic with respect to the plaintext and associated data, and it is designed to be resistant to nonce misuse since no random nonce is required. The determinism means identical plaintexts with identical associated data can produce identical ciphertexts, which can reveal repetition in some scenarios; this is a consideration in suitability and design.

Standards and implementations: AES-SIV is defined in RFC 5297. It is implemented in various cryptographic libraries and in the Linux kernel’s crypto API (as aessiv or aes-siv), among others. It is used in contexts where deterministic encryption and straightforward nonce management are advantageous.

Notes and use cases: Suitable for environments where nonce handling is problematic or where deterministic encryption with authenticated data is desirable. It is not always ideal for applications that require strong semantic security against pattern leakage, due to its deterministic nature.