<?xml version = "1.0" encoding = "utf-8"?> version='1.0' encoding='UTF-8'?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
<?xml-stylesheet type='text/xsl' href='rfc2629.xslt' ?> "rfc2629-xhtml.ent">

<?rfc toc="yes"?>
<?rfc tocdepth="4"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes" ?>
<?rfc compact="no" ?>
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" number="9058" category="info" docName="draft-smyshlyaev-mgm-20" ipr="trust200902"> ipr="trust200902" obsoletes="" updates="" submissionType="independent" xml:lang="en" tocInclude="true" tocDepth="4" symRefs="true" sortRefs="true" version="3">

  <front>
    <title abbrev="Multilinear Galois Mode (MGM)">
            Multilinear Galois Mode (MGM)
    </title>
    <seriesInfo name="RFC" value="9058"/>
    <author fullname="Stanislav Smyshlyaev" initials="S.V." initials="S" role="editor" surname="Smyshlyaev">
      <organization>CryptoPro</organization>
      <address>
        <phone>+7 (495) 995-48-20</phone>
        <email>svs@cryptopro.ru</email>
      </address>
    </author>
    <author fullname="Vladislav Nozdrunov" initials="V.N." initials="V" surname="Nozdrunov">
      <organization>TC 26</organization>
      <address>
        <email>nozdrunov_vi@tc26.ru</email>
      </address>
    </author>
    <author fullname="Vasily Shishkin" initials="V.S." initials="V" surname="Shishkin">
      <organization>TC 26</organization>
      <address>
        <email>shishkin_va@tc26.ru</email>
      </address>
    </author>
    <author fullname="Ekaterina Griboedova" initials="E.S." initials="E" surname="Griboedova">
      <organization>CryptoPro</organization>
      <address>
        <email>griboedovaekaterina@gmail.com</email>
      </address>
    </author>
    <date year="2021" />
        <!--если не указываем число и месяц, они подставляются автоматически--> month="June" year="2021"/>

        <area>General</area>
        <!--как в rfc7748-->

        <workgroup>Network Working Group</workgroup>
    <keyword>authenticated encryption, mode encryption</keyword>
    <keyword>mode of operation, AEAD</keyword> operation</keyword>
    <keyword>AEAD</keyword>
    <abstract>

      <t>
                Multilinear Galois Mode (MGM) is an authenticated encryption Authenticated Encryption
                with associated data Associated Data (AEAD) block cipher mode based on EtM the
                Encrypt-then-MAC (EtM) principle. MGM is defined for use with
                64-bit and 128-bit block ciphers.
      </t>

      <t>
                MGM has been standardized in Russia. It is used as an AEAD
                mode for the GOST block cipher algorithms in many protocols, e.g.
                e.g., TLS 1.3 and IPsec. This document provides a reference for
                MGM to enable review of the mechanisms in use and to make MGM
                available for use with any block cipher.
      </t>
    </abstract>
  </front>
  <middle>
    <section title="Introduction" anchor="Introduction"> anchor="Introduction" numbered="true" toc="default">
      <name>Introduction</name>
      <t>
                Multilinear Galois Mode (MGM) is an authenticated encryption Authenticated Encryption
                with associated data Associated Data (AEAD) block cipher mode based on EtM
                principle. MGM is defined for use with 64-bit and 128-bit
                block ciphers.  The MGM design principles can easily be
                applied to other block sizes.
      </t>
      <t>
                MGM has been standardized in Russia <xref target="R1323565.1.026-2019"/>.
                target="AUTH-ENC-BLOCK-CIPHER" format="default"/>. It is used as
                an AEAD mode for the GOST block cipher algorithms in many
                protocols, e.g. e.g., TLS 1.3 and IPsec. This document provides a
                reference for MGM to enable review of the mechanisms in use
                and to make MGM available for use with any block cipher.
      </t>
      <t>
                This document does not have IETF consensus and does not imply
                IETF support for MGM.
      </t>
    </section>
    <section title="Conventions numbered="true" toc="default">
      <name>Conventions Used in This Document"> Document</name>
      <t>
                The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT",
                "RECOMMENDED", "NOT RECOMMENDED", "MAY", "<bcp14>MUST</bcp14>", "<bcp14>MUST
                NOT</bcp14>", "<bcp14>REQUIRED</bcp14>",
                "<bcp14>SHALL</bcp14>", "<bcp14>SHALL NOT</bcp14>",
                "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>",
                "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT
                RECOMMENDED</bcp14>", "<bcp14>MAY</bcp14>", and "OPTIONAL"
                "<bcp14>OPTIONAL</bcp14>" in this document are to be
                interpreted as described in BCP 14 BCP&nbsp;14 <xref target="RFC2119"/> target="RFC2119"
                format="default"/> <xref target="RFC8174"/> target="RFC8174" format="default"/>
                when, and only when, they appear in all capitals, as shown
                here.
      </t>
    </section>
    <section title="Basic anchor="Definition" numbered="true" toc="default">
      <name>Basic Terms and Definitions" anchor="Definition"> Definitions</name>
      <t> This document uses the following terms and definitions for the sets and operations
                on the elements of these sets:
                <list style = "hanging" hangIndent = "8">
                    <t hangText = "V*">
                        the
      </t>
      <dl newline="false" spacing="normal" indent="10">
        <dt>V*</dt>
        <dd>
                        The set of all bit strings of a finite length
                        (hereinafter referred to as strings), including the
                        empty string; substrings and string components are
                        enumerated from right to left starting from zero;
                    </t>
                    <t hangText = "V_s">
                        the zero.
                    </dd>
        <dt>V_s</dt>
        <dd>
                        The set of all bit strings of length s, where s is a
                        non-negative integer. For s = 0, the V_0 consists of a
                        single empty string;
                    </t>
                    <t hangText = "|X|">
                        the string.
                    </dd>
        <dt>|X|</dt>
        <dd>
                        The bit length of the bit string X (if X is an empty
                        string, then |X| = 0);
                    </t>
                    <t hangText = "X || Y">
                        concatenation 0).
                    </dd>
        <dt>X || Y</dt>
        <dd>
                        Concatenation of strings X and Y both belonging to V*,
                        i.e., a string from V_{|X|+|Y|}, where the left
                        substring from V_{|X|} is equal to X, and the right
                        substring from V_{|Y|} is equal to Y;
                    </t>
                    <t hangText = "a^s">
                        the Y.
                    </dd>
        <dt>a^s</dt>
        <dd>
                        The string in V_s that consists of s 'a' bits;
                    </t>
                    <t hangText = "(xor)">
                        exclusive-or bits.
                    </dd>
        <dt>(xor)</dt>
        <dd>
                        Exclusive-or of the two bit strings of the same length;
                    </t>
                    <t hangText = "Z_{2^s}">
                        ring
                        length.
                    </dd>
        <dt>Z_{2^s}</dt>
        <dd>
                        Ring of residues modulo 2^s;
                    </t>
                    <t hangText = "MSB_i: 2^s.
                    </dd>
        <dt>MSB_i</dt> <dd><t> V_s -> V_i">
                        the -&gt; V_i</t>

                       <t>The transformation that maps the string X =
                       (x_{s-1}, ... , x_0) in V_s into the string MSB_i(X) =
                       (x_{s-1}, ... , x_{s-i}) in V_i, i &lt;= s, s (most
                       significant bits);
                    </t>
                    <t hangText = "Int_s: V_s -> Z_{2^s}">
                        the bits).</t>
                    </dd>
        <dt>Int_s</dt><dd> <t>V_s -&gt; Z_{2^s}</t>

                       <t>The transformation that maps the string X =
                       (x_{s-1}, ... , x_0) in V_s, s > &gt; 0, into the integer
                       Int_s(X) = 2^{s-1} * x_{s-1} + ... + 2 * x_1 + x_0 (the
                       interpretation of the bit string as an integer);
                    </t>
                    <t hangText = "Vec_s: integer).</t>
                    </dd>
        <dt>Vec_s</dt><dd><t> Z_{2^s} -> V_s">
                        the -&gt; V_s</t>

                       <t>The transformation inverse to the mapping Int_s
                       (the interpretation of an integer as a bit string);
                    </t>
                    <t hangText = "E_K: V_n -> V_n">
                        the string).</t>
                    </dd>
        <dt>E_K</dt><dd><t>V_n -&gt; V_n</t>

                       <t>The block cipher permutation under the key K in V_k;
                    </t>
                    <t hangText = "k">
                        the V_k.</t>
                    </dd>
        <dt>k</dt>
        <dd>
                        The bit length of the block cipher key;
                    </t>
                    <t hangText = "n">
                        the key.
                    </dd>
        <dt>n</dt>
        <dd>
                        The block size of the block cipher (in bits);
                    </t>
                    <t hangText = "len: bits).
                    </dd>
        <dt>len</dt><dd><t> V_s -> V_{n/2}">
                        the -&gt; V_{n/2}</t>

                        <t>The transformation that maps a string X in V_s, 0
                        &lt;= s &lt;= 2^{n/2} - 1, into the string len(X) =
                        Vec_{n/2}(|X|) in V_{n/2}, where n is the block size
                        of the used block cipher;
                    </t>
                    <t hangText = "[+]">
                        the cipher.</t>
                    </dd>
        <dt>[+]</dt>
        <dd>
                        The addition operation in Z_{2^{n/2}}, where n is the
                        block size of the used block cipher;
                    </t>
                    <t hangText = "(x)">
                        the cipher.
                    </dd>
        <dt>(x)</dt>
        <dd>
                        The transformation that maps two strings strings, X = (x_{n-1},
                        ... , x_0) in V_n and Y = (y_{n-1}, ... , y_0) y_0), in V_n
                        into the string Z = X (x) Y = (z_{n-1}, ... , z_0) in
                        V_n; the string Z corresponds to the polynomial Z(w) =
                        z_{n-1} * w^{n-1} + ... + z_1 * w + z_0 z_0, which is the
                        result of multiplying the polynomials X(w) = x_{n-1} *
                        w^{n-1} + ... + x_1 * w + x_0 and Y(w) = y_{n-1} *
                        w^{n-1} + ... + y_1 * w + y_0 in the field GF(2^n),
                        where n is the block size of the used block cipher; if
                        n = 64, then the field polynomial is equal to f(w) =
                        w^64 + w^4 + w^3 + w + 1; if n = 128, then the field
                        polynomial is equal to f(w) = w^128 + w^7 + w^2 + w + 1;
                    </t>
                    <t hangText = "incr_l:
                        1.
        </dd>

        <dt>incr_l</dt><dd><t> V_n -> V_n">
                        the -&gt; V_n</t>
<t>
The transformation that maps a an n-byte string A = L || R, where L, R in V_{n/2}, into the n-byte
string incr_l(L || R) incr_l(A) = Vec_{n/2}(Int_{n/2}(L) [+] 1) || R; R, where L and R are
n/2-byte strings.
</t>
                    <t hangText = "incr_r: V_n -> V_n">
                        the

                    </dd>
        <dt>incr_r</dt>
<dd><t>V_n -&gt; V_n</t>

<t>
The transformation that maps a an n-byte string A = L || R, where L, R in V_{n/2}, into the n-byte
string incr_r(L || R) incr_r(A) = L || Vec_{n/2}(Int_{n/2}(R) [+] 1).
                    </t>
                </list> 1), where L and R are
n/2-byte strings.
</t>

                    </dd>
      </dl>
    </section>

    <section title="Specification"> numbered="true" toc="default">
      <name>Specification</name>
      <t>
                An additional parameter that defines the functioning of Multilinear Galois Mode (MGM)
                MGM is the bit length S of the
                authentication tag, 32 &lt;= S &lt;= n. The value of S MUST
                <bcp14>MUST</bcp14> be fixed for a particular protocol.  The
                choice of the value S involves a trade-off between message
                expansion and the forgery probability.
      </t>
      <section title="MGM anchor="ENC" numbered="true" toc="default">
        <name>MGM Encryption and Tag Generation Procedure" anchor="ENC"> Procedure</name>
        <t>
                    The MGM encryption and tag generation procedure takes the
                    following parameters as inputs:
                    <list style="numbers">
                        <t>
        </t>
        <ol spacing="normal" type="1"><li>
                            Encryption key K in V_k.
                        </t>
                        <t>
                        </li>

          <li>
                            Initial counter nonce ICN in V_{n-1}.
                        </t>
                        <t>
                        </li>
          <li>
                            Associated authenticated data A, 0 &lt;= |A| &lt;
                            2^{n/2}. If |A| > &gt; 0, then A = A_1 || ... ||
                            A*_h, A_j in V_n, for j = 1, ... , h - 1, A*_h in
                            V_t, 1 &lt;= t &lt;= n. If |A| = 0, then by
                            definition A*_h is empty, and the h and t
                            parameters are set as follows: h = 0, t = n.  The
                            associated data is authenticated but is not
                            encrypted.
                        </t>
                        <t>
                        </li>
          <li>
                            Plaintext P, 0 &lt;= |P| &lt; 2^{n/2}. If |P| > &gt;
                            0, then P = P_1 || ... || P*_q, P_i in V_n, for i
                            = 1, ... , q - 1, P*_q in V_u, 1 &lt;= u &lt;=
                            n. If |P| = 0, then by definition P*_q is empty,
                            and the q and u parameters are set as follows: q =
                            0, u = n.
                        </t>
                    </list>
                </t>
                        </li>
        </ol>
        <t>
                    The MGM encryption and tag generation procedure outputs
                    the following parameters:
                    <list style="numbers">
                        <t>Initial
        </t>
        <ol spacing="normal" type="1"><li>Initial counter nonce ICN.</t>
                        <t>Associated ICN.</li>
          <li>Associated authenticated data A.</t>
                        <t>Ciphertext A.</li>
          <li>Ciphertext C in V_{|P|}.</t>
                        <t>Authentication V_{|P|}.</li>
          <li>Authentication tag T in V_S.</t>
                    </list>
                </t> V_S.</li>
        </ol>
        <t>
                    The MGM encryption and tag generation procedure consists
                    of the following steps:
        </t>
                <t>
                    <figure>
                        <artwork>
                            <![CDATA[

<sourcecode type="pseudocode"><![CDATA[
   +----------------------------------------------------------------+
   |  MGM-Encrypt(K, ICN, A, P)                                     |
   |----------------------------------------------------------------|
   |  1. Encryption step:                                           |
   |      - if |P| = 0 then                                         |
   |            - C*_q = P*_q                                       |
   |            - C = P                                             |
   |      - else                                                    |
   |            - Y_1 = E_K(0^1 || ICN),                            |
   |            - For i = 2, 3, ... , q do                          |
   |                    Y_i = incr_r(Y_{i-1}),                      |
   |            - For i = 1, 2, ... , q - 1 do                      |
   |                    C_i = P_i (xor) E_K(Y_i),                   |
   |            - C*_q = P*_q (xor) MSB_u(E_K(Y_q)),                |
   |            - C = C_1 || ... || C*_q.                           |
   |                                                                |
   |  2. Padding step:                                              |
   |      - A_h = A*_h || 0^{n-t},                                  |
   |      - C_q = C*_q || 0^{n-u}.                                  |
   |                                                                |
   |  3. Authentication tag T generation step:                      |
   |      - Z_1 = E_K(1^1 || ICN),                                  |
   |      - sum = 0^n,                                              |
   |      - For i = 1, 2, ..., h do                                 |
   |              H_i = E_K(Z_i),                                   |
   |              sum = sum (xor) ( H_i (x) A_i ),                  |
   |              Z_{i+1} = incr_l(Z_i),                            |
   |      - For j = 1, 2, ..., q do                                 |
   |              H_{h+j} = E_K(Z_{h+j}),                           |
   |              sum = sum (xor) ( H_{h+j} (x) C_j ),              |
   |              Z_{h+j+1} = incr_l(Z_{h+j}),                      |
   |      - H_{h+q+1} = E_K(Z_{h+q+1}),                             |
   |      - T = MSB_S(E_K(sum (xor) ( H_{h+q+1} (x)                 |
   |                       ( len(A) || len(C) ) ))).                |
   |                                                                |
   |  4. Return (ICN, A, C, T).                                     |
   +----------------------------------------------------------------+
                        ]]>
                        </artwork>
                    </figure>
                </t>
]]></sourcecode>

        <t>
                    The ICN value for each message that is encrypted under
                    the given key K must be chosen in a unique manner.
        </t>
        <t>
                    Users who do not wish to encrypt plaintext can provide a
                    string P of zero length. Users who do not wish to
                    authenticate associated data can provide a string A of
                    zero length. The length of the associated data A and of
                    the plaintext P MUST <bcp14>MUST</bcp14> be such that 0 &lt;
                    |A| + |P| &lt; 2^{n/2}.
        </t>
      </section>
      <section title="MGM numbered="true" toc="default">
        <name>MGM Decryption and Tag Verification Check Procedure"> Procedure</name>

        <t>
                    The MGM decryption and tag verification procedure takes the following parameters as inputs:
                    <list style="numbers">
                        <t>
        </t>
        <ol spacing="normal" type="1"><li>
                            Encryption key K in V_k.
                        </t>
                        <t>
                        </li>
          <li>
                            Initial counter nonce ICN in V_{n-1}.
                        </t>
                        <t>
                        </li>
          <li>
                            Associated authenticated data A, 0 &lt;= |A| &lt;
                            2^{n/2}. If |A| > &gt; 0, then A = A_1 || ... ||
                            A*_h, A_j in V_n, for j = 1, ... , h - 1, A*_h in
                            V_t, 1 &lt;= t &lt;= n. If |A| = 0, then by
                            definition A*_h is empty, and the h and t
                            parameters are set as follows: h = 0, t = n.  The
                            associated data is authenticated but is not
                            encrypted.
                        </t>
                        <t>
                        </li>
          <li>
                            Ciphertext C, 0 &lt;= |C| &lt; 2^{n/2}. If |C| > &gt; 0, then C = C_1 || ... || C*_q, C_i in V_n, for i = 1, ... , q - 1, C*_q in V_u, 1 &lt;= u &lt;= n.
                            If |C| = 0, then by definition C*_q is empty, and the q and u parameters
                            are set as follows: q = 0, u = n.
                        </t>
                        <t>
                        </li>
          <li>
                            Authentication tag T in V_S.
                        </t>
                    </list>
                </t>
                        </li>
        </ol>
        <t>
                    The MGM decryption and tag verification procedure outputs FAIL or the following parameters:
                    <list style="numbers">
                        <t>Associated
        </t>
        <ol spacing="normal" type="1"><li>Associated authenticated data A.</t>
                        <t>Plaintext A.</li>
          <li>Plaintext P in V_{|C|}.</t>
                    </list>
                </t> V_{|C|}.</li>
        </ol>
        <t>
                    The MGM decryption and tag verification procedure consists of the following steps:
        </t>
                <t>
                    <figure>
                        <artwork>
                            <![CDATA[

<sourcecode type="pseudocode"><![CDATA[
   +----------------------------------------------------------------+
   |  MGM-Decrypt(K, ICN, A, C, T)                                  |
   |----------------------------------------------------------------|
   |  1. Padding step:                                              |
   |      - A_h = A*_h || 0^{n-t},                                  |
   |      - C_q = C*_q || 0^{n-u}.                                  |
   |                                                                |
   |  2. Authentication tag T verification step:                    |
   |      - Z_1 = E_K(1^1 || ICN),                                  |
   |      - sum = 0^n,                                              |
   |      - For i = 1, 2, ..., h do                                 |
   |              H_i = E_K(Z_i),                                   |
   |              sum = sum (xor) ( H_i (x) A_i ),                  |
   |              Z_{i+1} = incr_l(Z_i),                            |
   |      - For j = 1,  2, ..., q do                                |
   |              H_{h+j} = E_K(Z_{h+j}),                           |
   |              sum = sum (xor) ( H_{h+j} (x) C_j ),              |
   |              Z_{h+j+1} = incr_l(Z_{h+j}),                      |
   |      - H_{h+q+1} = E_K(Z_{h+q+1}),                             |
   |      - T' = MSB_S(E_K(sum (xor) ( H_{h+q+1} (x)                |
   |                       ( len(A) || len(C) ) ))),                |
   |      - If T' != T then return FAIL.                            |
   |                                                                |
   |  3. Decryption step:                                           |
   |      - if |C| = 0 then                                         |
   |            - P = C                                             |
   |      - else                                                    |
   |            - Y_1 = E_K(0^1 || ICN),                            |
   |            - For i = 2, 3, ... , q do                          |
   |                    Y_i = incr_r(Y_{i-1}),                      |
   |            - For i = 1, 2, ... , q - 1 do                      |
   |                    P_i = C_i (xor) E_K(Y_i),                   |
   |            - P*_q = C*_q (xor) MSB_u(E_K(Y_q)),                |
   |            - P = P_1 || ... || P*_q.                           |
   |                                                                |
   |  4. Return (A, P).                                             |
   +----------------------------------------------------------------+
                        ]]>
                        </artwork>
                    </figure>
                </t>
]]></sourcecode>

        <t>
                    The length of the associated data A and of the ciphertext C MUST <bcp14>MUST</bcp14> be such that 0 &lt; |A| + |C|  &lt; 2^{n/2}.
        </t>
      </section>
    </section>
    <section anchor="RefRationale" title="Rationale"> numbered="true" toc="default">
      <name>Rationale</name>
      <t>
                The
                MGM was originally proposed in <xref target="PDMODE"/>. target="PDMODE" format="default"/>.
      </t>
      <t>
                From the operational point of view the view, MGM is designed to be
                parallelizable, inverse-free, inverse free, and online and is also designed to provide
                availability of precomputations.
      </t>
      <t>
                Parallelizability of the MGM is achieved due to its
                counter-type structure and the usage of the multilinear
                function for authentication. Indeed, both encryption blocks
                E_K(Y_i) and authentication blocks H_i are produced in the
                counter mode manner, and the multilinear function determined
                by H_i is parallelizable in itself.  Additionally, the
                counter-type structure of the mode provides the inverse-free
                property.
      </t>
      <t>
                The online property means the possibility to process message of processing messages
                even if it is not completely received (so its length is
                unknown). To provide this property the property, MGM uses blocks
                E_K(Y_i) and H_i H_i, which are produced basing based on two independent
                source blocks Y_i and Z_i.
      </t>
      <t>
                Availability of precomputations for the MGM means the possibility to calculate of calculating H_i and E_K(Y_i) even before
                data is retrieved. It holds again due to the usage of counters for calculating them.
      </t>
    </section>
    <section anchor="Security" title="Security Considerations"> numbered="true" toc="default">
      <name>Security Considerations</name>
      <t>

      The security properties of the MGM are based on the following:
                <list style="symbols">
                    <t>
      </t>

      <dl spacing="normal" newline="true">

        <dt> Different functions generating the counter values: <vspace/>
                        The </dt>
        <dd>The functions incr_r and incr_l are chosen to minimize
        intersection (if it happens) of counter values Y_i and Z_i.
                    </t>
                    <t> Z_i.</dd>
        <dt> Encryption of the multilinear function output:<vspace/> output:</dt>
        <dd> It allows to resist attacks based on padding
        and linear properties to be resisted (see <xref target="Ferg05"/> target="FERG05" format="default"/> for details).
                    </t>
                    <t> details).</dd>
        <dt>  Multilinear function for authentication:<vspace/> authentication:</dt>
        <dd> It allows to resist the small subgroup attacks to be resisted <xref target="Saar12"/>.
                    </t>
                    <t> target="SAAR12" format="default"/>.</dd>
        <dt> Encryption of the nonces (0^1 || ICN) and (1^1 || ICN):<vspace/> ICN):</dt>
        <dd> The use of this encryption minimizes the number of
        plaintext/ciphertext pairs of blocks known to an adversary.

It allows to resist prevents attacks that need a substantial amount of such material (e.g.,
linear and differential cryptanalysis, cryptanalysis and side-channel attacks).
                    </t>
                </list>
            </t>

</dd>

      </dl>

      <t>
                It is crucial to the security of MGM to use unique ICN
                values. Using the same ICN values for two different messages
                encrypted with the same key eliminates the security properties
                of this mode.
      </t>
      <t>
                It is crucial for the security of MGM not to process empty
                plaintext and empty associated data at the same
                time. Otherwise, a tag becomes independent from a nonce value,
                leading to vulnerability to forgery attack. attacks.
      </t>
      <t>
                Security analysis for MGM with E_K being a random permutation
                was performed in <xref target="SecMGM"/>. target="SEC-MGM"
                format="default"/>. More precisely, the bounds for
                confidentiality advantage (CA) and integrity advantage (IA)
                (for details details, see <xref target="I-D.irtf-cfrg-aead-limits"/>) target="I-D.irtf-cfrg-aead-limits"
                format="default"/>) were obtained. According to these results,
                for an adversary making at most q encryption queries with the
                total length of plaintexts and associated data of at most s blocks
                blocks, and allowed to output a forgery with the summary length
                of ciphertext and associated data of at most l blocks:
                <list  style = "empty">
                    <t>
                        CA
      </t>

<t indent="6">CA &lt;= ( 3( s + 4q )^2 )/ 2^n,
</t>
                    <t>
                        IA

<t indent="6">IA &lt;= ( 3( s + 4q + l + 3 )^2 )/ 2^n + 2/2^S,
</t>
                </list>

      <t>
                where n is the block size and S is the authentication tag size.
      </t>
      <t>
                These bounds can be used as guidelines on how to calculate
                confidentiality and integrity limits (for details details, also see
                <xref target="I-D.irtf-cfrg-aead-limits"/>). target="I-D.irtf-cfrg-aead-limits" format="default"/>).
      </t>
    </section>
    <section anchor="IANA" title="IANA Considerations"> numbered="true" toc="default">
      <name>IANA Considerations</name>
      <t>
This document does not require any has no IANA actions.
      </t>
    </section>
  </middle>
  <back>
        <references title="Normative References">
            <?rfc include='http://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml' ?>
            <?rfc include='http://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.7801.xml' ?>
            <?rfc include='http://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.8174.xml' ?>
            <?rfc include='http://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.8891.xml' ?>

<displayreference target="I-D.irtf-cfrg-aead-limits" to="AEAD-LIMITS"/>
    <references>
      <name>References</name>
      <references>
        <name>Normative References</name>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.7801.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8174.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8891.xml"/>
      </references>
        <references title="Informative References">

            <?rfc include='http://xml2rfc.tools.ietf.org/public/rfc/bibxml-ids/reference.I-D.draft-irtf-cfrg-aead-limits-01.xml' ?>
      <references>
        <name>Informative References</name>

        <xi:include href="https://datatracker.ietf.org/doc/bibxml3/draft-irtf-cfrg-aead-limits.xml"/>

        <reference anchor="PDMODE">
          <front>
                    <title>
                        Parallel
            <title>Parallel and double block cipher mode of operation (PD-mode) for authenticated encryption
            </title>
                    <author>
                        <organization>
                            Nozdrunov, V.
                        </organization>
            <author fullname="Vladislav Nozdrunov" initials="V." surname="Nozdrunov">
              <organization/>
            </author>
            <date month="June" year="2017"/>
          </front>
                <seriesInfo name="CTCrypt
          <refcontent>CTCrypt 2017 proceedings," value="pp. 36-45"/> proceedings, pp. 36-45 </refcontent>
        </reference>

        <reference anchor="GOST3412-2015">
          <front>
                    <title>
                        Information
            <title>Information technology. Cryptographic data security. Block ciphers
            </title>
            <author>
                        <organization>
                            Federal
              <organization>Federal Agency on Technical Regulating and Metrology
              </organization>
            </author>
            <date year="2015"/>
          </front>
                <seriesInfo name="GOST R" value="34.12-2015"/>
          <refcontent>GOST R 34.12-2015</refcontent>
        </reference>

        <reference anchor="Ferg05"> anchor="FERG05">
          <front>
                    <title>
                        Authentication
            <title>Authentication weaknesses in GCM
            </title>
                    <author>
                        <organization>
                            Ferguson, N.
                        </organization>
            <author fullname="Niels Ferguson" initials="N" surname="Ferguson">
              <organization/>
            </author>
            <date year="2005"/> year="2005" month="May"/>
          </front>
        </reference>

        <reference anchor="R1323565.1.026-2019"> anchor="AUTH-ENC-BLOCK-CIPHER">
          <front>
            <title>
                        Information technology. Cryptographic data
                        security. Authenticated encryption block cipher
                        operation modes
            </title>
            <author>
              <organization>
                            Federal Agency on Technical Regulating and Metrology
              </organization>
            </author>
            <date year="2019"/>
          </front>
                <seriesInfo name="R" value="1323565.1.026-2019"/>
          <refcontent>R 1323565.1.026-2019</refcontent>
        </reference>

        <reference anchor="Saar12"> anchor="SAAR12">
          <front>
                    <title>
                        Cycling
            <title>Cycling Attacks on GCM, GHASH and Other Polynomial MACs and Hashes
            </title>
                    <author>
                        <organization>
                            Saarinen, O.
                        </organization>
            <author fullname="Markku-Juhani Olavi Saarinen" initials="M-J" surname="Saarinen">
              <organization>Fast Software Encryption</organization>
            </author>
            <date year="2012"/>
          </front>
                 <seriesInfo name="FSE
        <refcontent>FSE 2012 proceedings," value="pp. 216-225"/> proceedings, pp. 216-225</refcontent>
        <seriesInfo name="DOI" value="10.1007/978-3-642-34047-5_13"/>
        </reference>

        <reference anchor="SecMGM"> anchor="SEC-MGM">
          <front>
                    <title>
                        Security
            <title>Security of Multilinear Galois Mode (MGM). (MGM)
            </title>
                    <author>
                        <organization>
                            Akhmetzyanova, L., Alekseev, E., Karpunin, G. and V. Nozdrunov
                        </organization>
                    </author>
            <author fullname="Liliya Akhmetzyanova" initials="L" surname="Akhmetzyanova"/>
<author fullname="Evgeny Alekseev" initials="E" surname="Alekseev"/>
<author fullname="Grigory Karpunin" initials="G" surname="Karpunin"/>
<author fullname="Vladislav Nozdrunov" initials="V" surname="Nozdrunov"/>
            <date year="2019"/>
          </front>
                <seriesInfo name="IACR
<refcontent>IACR Cryptology ePrint Archive 2019," value="p. 123"/> 2019, pp. 123</refcontent>
        </reference>
      </references>
    </references>

    <section anchor="Appendix" title="Test Vectors"> numbered="true" toc="default">
      <name>Test Vectors</name>
      <section title="Test numbered="true" toc="default">
        <name>Test Vectors for the Kuznyechik block cipher"> Block Cipher</name>
        <t>
                     Test vectors for the Kuznyechik block cipher (n = 128, k = 256) are defined in <xref target="GOST3412-2015"/> target="GOST3412-2015" format="default"/> (the English version can be found in <xref target="RFC7801"/>). target="RFC7801" format="default"/>).
        </t>
                 <t>
                     <figure>
                         <artwork>
                             <![CDATA[
-------------------------Example 1--------------------------
	<section anchor="example1">
	  <name>Example 1</name>
        <sourcecode><![CDATA[
Encryption key K:
00000:   88 99 AA BB CC DD EE FF 00 11 22 33 44 55 66 77
00010:   FE DC BA 98 76 54 32 10 01 23 45 67 89 AB CD EF

ICN:
00000:   11 22 33 44 55 66 77 00 FF EE DD CC BB AA 99 88

Associated authenticated data A:
00000:   02 02 02 02 02 02 02 02 01 01 01 01 01 01 01 01
00010:   04 04 04 04 04 04 04 04 03 03 03 03 03 03 03 03
00020:   EA 05 05 05 05 05 05 05 05

Plaintext P:
00000:   11 22 33 44 55 66 77 00 FF EE DD CC BB AA 99 88
00010:   00 11 22 33 44 55 66 77 88 99 AA BB CC EE FF 0A
00020:   11 22 33 44 55 66 77 88 99 AA BB CC EE FF 0A 00
00030:   22 33 44 55 66 77 88 99 AA BB CC EE FF 0A 00 11
00040:   AA BB CC

1. Encryption step:
]]></sourcecode>

<ol>
<li><t>Encryption step:</t>
 <sourcecode><![CDATA[
0^1 || ICN:
00000:   11 22 33 44 55 66 77 00 FF EE DD CC BB AA 99 88

Y_1:
00000:   7F 67 9D 90 BE BC 24 30 5A 46 8D 42 B9 D4 ED CD
E_K(Y_1):
00000:   B8 57 48 C5 12 F3 19 90 AA 56 7E F1 53 35 DB 74

Y_2:
00000:   7F 67 9D 90 BE BC 24 30 5A 46 8D 42 B9 D4 ED CE
E_K(Y_2):
00000:   80 64 F0 12 6F AC 9B 2C 5B 6E AC 21 61 2F 94 33

Y_3:
00000:   7F 67 9D 90 BE BC 24 30 5A 46 8D 42 B9 D4 ED CF
E_K(Y_3):
00000:   58 58 82 1D 40 C0 CD 0D 0A C1 E6 C2 47 09 8F 1C

Y_4:
00000:   7F 67 9D 90 BE BC 24 30 5A 46 8D 42 B9 D4 ED D0
E_K(Y_4):
00000:   E4 3F 50 81 B5 8F 0B 49 01 2F 8E E8 6A CD 6D FA

Y_5:
00000:   7F 67 9D 90 BE BC 24 30 5A 46 8D 42 B9 D4 ED D1
E_K(Y_5):
00000:   86 CE 9E 2A 0A 12 25 E3 33 56 91 B2 0D 5A 33 48

C:
00000:   A9 75 7B 81 47 95 6E 90 55 B8 A3 3D E8 9F 42 FC
00010:   80 75 D2 21 2B F9 FD 5B D3 F7 06 9A AD C1 6B 39
00020:   49 7A B1 59 15 A6 BA 85 93 6B 5D 0E A9 F6 85 1C
00030:   C6 0C 14 D4 D3 F8 83 D0 AB 94 42 06 95 C7 6D EB
00040:   2C 75 52

2. Padding step:
]]></sourcecode>
</li>

<li><t>Padding step:</t>

 <sourcecode><![CDATA[
A_1 || ... || A_h:
00000:   02 02 02 02 02 02 02 02 01 01 01 01 01 01 01 01
00010:   04 04 04 04 04 04 04 04 03 03 03 03 03 03 03 03
00020:   EA 05 05 05 05 05 05 05 05 00 00 00 00 00 00 00

C_1 || ... || C_q:
00000:   A9 75 7B 81 47 95 6E 90 55 B8 A3 3D E8 9F 42 FC
00010:   80 75 D2 21 2B F9 FD 5B D3 F7 06 9A AD C1 6B 39
00020:   49 7A B1 59 15 A6 BA 85 93 6B 5D 0E A9 F6 85 1C
00030:   C6 0C 14 D4 D3 F8 83 D0 AB 94 42 06 95 C7 6D EB
00040:   2C 75 52 00 00 00 00 00 00 00 00 00 00 00 00 00

3. Authentication
]]></sourcecode>
</li>

<li><t>Authentication tag T generation step: step:</t>
 <sourcecode><![CDATA[
1^1 || ICN:
00000:   91 22 33 44 55 66 77 00 FF EE DD CC BB AA 99 88

Z_1:
00000:   7F C2 45 A8 58 6E 66 02 A7 BB DB 27 86 BD C6 6F
H_1:
00000:   8D B1 87 D6 53 83 0E A4 BC 44 64 76 95 2C 30 0B
current sum:
00000:   4C F4 27 F4 AD B7 5C F4 C0 DA 39 D5 AB 48 CF 38

Z_2:
00000:   7F C2 45 A8 58 6E 66 03 A7 BB DB 27 86 BD C6 6F
H_2:
00000:   7A 24 F7 26 30 E3 76 37 21 C8 F3 CD B1 DA 0E 31
current sum:
00000:   94 95 44 0E F6 24 A1 DD C6 F5 D9 77 28 50 C5 73

Z_3:
00000:   7F C2 45 A8 58 6E 66 04 A7 BB DB 27 86 BD C6 6F
H_3:
00000:   44 11 96 21 17 D2 06 35 C5 25 E0 A2 4D B4 B9 0A
current sum:
00000:   A4 9A 8C D8 A6 F2 74 23 DB 79 E4 4A B3 06 D9 42

Z_4:
00000:   7F C2 45 A8 58 6E 66 05 A7 BB DB 27 86 BD C6 6F
H_4:
00000:   D8 C9 62 3C 4D BF E8 14 CE 7C 1C 0C EA A9 59 DB
current sum:
00000:   09 FE 3F 6A 83 3C 21 B3 90 27 D0 20 6A 84 E1 5A

Z_5:
00000:   7F C2 45 A8 58 6E 66 06 A7 BB DB 27 86 BD C6 6F
H_5:
00000:   A5 E1 F1 95 33 3E 14 82 96 99 31 BF BE 6D FD 43
current sum:
00000:   B5 DA 26 BB 00 EB A8 04 35 D7 97 6B C6 B5 46 4D

Z_6:
00000:   7F C2 45 A8 58 6E 66 07 A7 BB DB 27 86 BD C6 6F
H_6:
00000:   B4 CA 80 8C AC CF B3 F9 17 24 E4 8A 2C 7E E9 D2
current sum:
00000:   DD 1C 0E EE F7 83 C8 EB 2A 33 F3 58 D7 23 0E E5

Z_7:
00000:   7F C2 45 A8 58 6E 66 08 A7 BB DB 27 86 BD C6 6F
H_7:
00000:   72 90 8F C0 74 E4 69 E8 90 1B D1 88 EA 91 C3 31
current sum:
00000:   89 6C E1 08 32 EB EA F9 06 9F 3F 73 76 59 4D 40

Z_8:
00000:   7F C2 45 A8 58 6E 66 09 A7 BB DB 27 86 BD C6 6F
H_8:
00000:   23 CA 27 15 B0 2C 68 31 3B FD AC B3 9E 4D 0F B8
current sum:
00000:   99 1A F5 C9 D0 80 F7 63 87 FE 64 9E 7C 93 C6 42

Z_9:
00000:   7F C2 45 A8 58 6E 66 0A A7 BB DB 27 86 BD C6 6F
H_9:
00000:   BC BC E6 C4 1A A3 55 A4 14 88 62 BF 64 BD 83 0D
len(A) || len(C):
00000:   00 00 00 00 00 00 01 48 00 00 00 00 00 00 02 18
sum (xor) ( H_9 (x) ( len(A) || len(C) ) ):
00000:   C0 C7 22 DB 5E 0B D6 DB 25 76 73 83 3D 56 71 28

Tag T:
00000:   CF 5D 65 6F 40 C3 4F 5C 46 E8 BB 0E 29 FC DB 4C
]]>
                    </artwork>
                </figure>
            </t>

             <t>
                 <figure>
                     <artwork>
                         <![CDATA[
-------------------------Example 2--------------------------
]]></sourcecode>
</li>
</ol>
      </section>

      <section anchor="example2">
	<name>Example 2</name>
        <sourcecode><![CDATA[
Encryption key K:
00000:   99 AA BB CC DD EE FF 00 11 22 33 44 55 66 77 FE
00010:   DC BA 98 76 54 32 10 01 23 45 67 89 AB CD EF 88

ICN:
00000:   11 22 33 44 55 66 77 00 FF EE DD CC BB AA 99 88

Associated authenticated data A:
00000:   01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01

Plaintext P:
00000:

1. Encryption step:
]]></sourcecode>
<ol>
  <li><t>Encryption step:</t>
   <sourcecode><![CDATA[
C:
00000:

2. Padding step:
]]></sourcecode>
  </li>

  <li><t>Padding step:</t>
   <sourcecode><![CDATA[
A_1 || ... || A_h:
00000:   01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01

C_1 || ... || C_q:
00000:

3. Authentication
]]></sourcecode>
  </li>

  <li><t>Authentication tag T generation step: step:</t>
   <sourcecode><![CDATA[
1^1 || ICN:
00000:   91 22 33 44 55 66 77 00 FF EE DD CC BB AA 99 88

Z_1:
00000:   79 32 72 68 96 C4 3E 3F BF D6 50 89 EB F1 E5 B6
H_1:
00000:   99 3A 80 66 CC C0 A4 0F AC 4A 14 F7 A2 F6 6D 9B
current sum:
00000:   0A C1 1E 2C 1C D6 07 D8 2F E3 55 54 B4 01 02 81

Z_2:
00000:   79 32 72 68 96 C4 3E 40 BF D6 50 89 EB F1 E5 B6
H_2:
00000:   0C 38 A7 1E E7 93 BF 76 89 81 BF CD 7C DA 78 C8
len(A) || len(C):
00000:   00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00
sum (xor) ( H_2 (x) ( len(A) || len(C) ) ):
00000:   CA 1E F8 92 71 EA 60 C4 53 9E 40 EB 26 C2 80 5D

Tag T:
00000:   79 01 E9 EA 20 85 CD 24 7E D2 49 69 5F 9F 8A 85
]]>
                     </artwork>
                 </figure>
             </t>
]]></sourcecode>
  </li>
</ol>
      </section>
    </section>
      <section title="Test numbered="true" toc="default">
        <name>Test Vectors for the Magma block cipher"> Block Cipher</name>
        <t>
                Test vectors for the Magma block cipher (n = 64, k = 256) are
                defined in <xref target="GOST3412-2015"/> target="GOST3412-2015" format="default"/>
                (the English version can be found in <xref target="RFC8891"/>). target="RFC8891"
                format="default"/>).
        </t>
            <t>
                <figure>
                    <artwork>
                        <![CDATA[
-------------------------Example 1--------------------------
	    <section anchor="examplemagma1">
	<name>Example 1</name>
        <sourcecode><![CDATA[
Encryption key K:
00000:   FF EE DD CC BB AA 99 88 77 66 55 44 33 22 11 00
00010:   F0 F1 F2 F3 F4 F5 F6 F7 F8 F9 FA FB FC FD FE FF

ICN:
00000:   12 DE F0 6B 3C 13 0A 59

Associated authenticated data A:
00000:   01 01 01 01 01 01 01 01 02 02 02 02 02 02 02 02
00010:   03 03 03 03 03 03 03 03 04 04 04 04 04 04 04 04
00020:   05 05 05 05 05 05 05 05 EA

Plaintext P:
00000:   FF EE DD CC BB AA 99 88 11 22 33 44 55 66 77 00
00010:   88 99 AA BB CC EE FF 0A 00 11 22 33 44 55 66 77
00020:   99 AA BB CC EE FF 0A 00 11 22 33 44 55 66 77 88
00030:   AA BB CC EE FF 0A 00 11 22 33 44 55 66 77 88 99
00040:   AA BB CC

1. Encryption step:
]]></sourcecode>

	<ol>

	  <li><t>Encryption step:</t>
	   <sourcecode><![CDATA[
0^1 || ICN:
00000:   12 DE F0 6B 3C 13 0A 59

Y_1:
00000:   56 23 89 01 62 DE 31 BF
E_K(Y_1):
00000:   38 7B DB A0 E4 34 39 B3

Y_2:
00000:   56 23 89 01 62 DE 31 C0
E_K(Y_2):
00000:   94 33 00 06 10 F7 F2 AE

Y_3:
00000:   56 23 89 01 62 DE 31 C1
E_K(Y_3):
00000:   97 B7 AA 6D 73 C5 87 57

Y_4:
00000:   56 23 89 01 62 DE 31 C2
E_K(Y_4):
00000:   94 15 52 8B FF C9 E8 0A

Y_5:
00000:   56 23 89 01 62 DE 31 C3
E_K(Y_5):
00000:   03 F7 68 BF F1 82 D6 70

Y_6:
00000:   56 23 89 01 62 DE 31 C4
E_K(Y_6):
00000:   FD 05 F8 4E 9B 09 D2 FE

Y_7:
00000:   56 23 89 01 62 DE 31 C5
E_K(Y_7):
00000:   DA 4D 90 8A 95 B1 75 C4

Y_8:
00000:   56 23 89 01 62 DE 31 C6
E_K(Y_8):
00000:   65 99 73 96 DA C2 4B D7

Y_9:
00000:   56 23 89 01 62 DE 31 C7
E_K(Y_9):
00000:   A9 00 50 4A 14 8D EE 26

C:
00000:   C7 95 06 6C 5F 9E A0 3B 85 11 33 42 45 91 85 AE
00010:   1F 2E 00 D6 BF 2B 78 5D 94 04 70 B8 BB 9C 8E 7D
00020:   9A 5D D3 73 1F 7D DC 70 EC 27 CB 0A CE 6F A5 76
00030:   70 F6 5C 64 6A BB 75 D5 47 AA 37 C3 BC B5 C3 4E
00040:   03 BB 9C

2. Padding step:
]]></sourcecode>
	  </li>

	  <li><t>Padding step:</t>
	  <sourcecode><![CDATA[
A_1 || ... || A_h:
00000:   01 01 01 01 01 01 01 01 02 02 02 02 02 02 02 02
00010:   03 03 03 03 03 03 03 03 04 04 04 04 04 04 04 04
00020:   05 05 05 05 05 05 05 05 EA 00 00 00 00 00 00 00

C_1 || ... || C_q:
00000:   C7 95 06 6C 5F 9E A0 3B 85 11 33 42 45 91 85 AE
00010:   1F 2E 00 D6 BF 2B 78 5D 94 04 70 B8 BB 9C 8E 7D
00020:   9A 5D D3 73 1F 7D DC 70 EC 27 CB 0A CE 6F A5 76
00030:   70 F6 5C 64 6A BB 75 D5 47 AA 37 C3 BC B5 C3 4E
00040:   03 BB 9C 00 00 00 00 00

3. Authentication
]]></sourcecode>
	  </li>

	  <li><t>Authentication tag T generation step: step:</t>
 <sourcecode><![CDATA[
1^1 || ICN:
00000:   92 DE F0 6B 3C 13 0A 59

Z_1:
00000:   2B 07 3F 04 94 F3 72 A0
H_1:
00000:   70 8A 78 19 1C DD 22 AA
current sum:
00000:   D6 BB 5B EA 81 93 12 62

Z_2:
00000:   2B 07 3F 05 94 F3 72 A0
H_2:
00000:   6F 02 CC 46 4B 2F A0 A3
current sum:
00000:   DD 1C 82 4E 91 78 49 A5

Z_3:
00000:   2B 07 3F 06 94 F3 72 A0
H_3:
00000:   9F 81 F2 26 FD 19 6F 05
current sum:
00000:   05 89 22 17 F6 5A DA C7

Z_4:
00000:   2B 07 3F 07 94 F3 72 A0
H_4:
00000:   B9 C2 AC 9B E5 B5 DF F9
current sum:
00000:   D1 DB 9B 7F C4 9E 7C 97

Z_5:
00000:   2B 07 3F 08 94 F3 72 A0
H_5:
00000:   74 B5 EC 96 55 1B F8 88
current sum:
00000:   56 45 F6 B5 18 5C B7 1A

Z_6:
00000:   2B 07 3F 09 94 F3 72 A0
H_6:
00000:   7E B0 21 A4 03 5B 04 C3
current sum:
00000:   3F C2 C2 E6 FB EE D0 4D

Z_7:
00000:   2B 07 3F 0A 94 F3 72 A0
H_7:
00000:   C2 A9 C3 A8 70 4D 9B B0
current sum:
00000:   15 47 1F B5 CD 8E 6C 02

Z_8:
00000:   2B 07 3F 0B 94 F3 72 A0
H_8:
00000:   F5 D5 05 A8 7B 83 83 B5
current sum:
00000:   12 56 78 96 1D 40 E0 93

Z_9:
00000:   2B 07 3F 0C 94 F3 72 A0
H_9:
00000:   F7 95 E7 5F DE B8 93 3C
current sum:
00000:   6E F4 0A B0 C1 5F 20 48

Z_10:
00000:   2B 07 3F 0D 94 F3 72 A0
H_10:
00000:   65 A1 A3 E6 80 F0 81 45
current sum:
00000:   A4 64 A7 08 FF 45 14 22

Z_11:
00000:   2B 07 3F 0E 94 F3 72 A0
H_11:
00000:   1C 74 A5 76 4C B0 D5 95
current sum:
00000:   60 94 4E 05 D0 85 75 14

Z_12:
00000:   2B 07 3F 0F 94 F3 72 A0
H_12:
00000:   DC 84 47 A5 14 E7 83 E7
current sum:
00000:   EE 98 B9 B5 0F F7 83 E8

Z_13:
00000:   2B 07 3F 10 94 F3 72 A0
H_13:
00000:   A7 E3 AF E0 04 EE 16 E3
current sum:
00000:   C0 39 0F A2 28 AF 6D CB

Z_14:
00000:   2B 07 3F 11 94 F3 72 A0
H_14:
00000:   A5 AA BB 0B 79 80 D0 71
current sum:
00000:   73 E0 6E 07 EF 37 CD CC

Z_15:
00000:   2B 07 3F 12 94 F3 72 A0
H_15:
00000:   6E 10 4C C9 33 52 5C 5D
current sum:
00000:   2F 40 69 0A EB 53 F5 39

Z_16:
00000:   2B 07 3F 13 94 F3 72 A0
H_16:
00000:   83 11 B6 02 4A A9 66 C1
len(A) || len(C):
00000:   00 00 01 48 00 00 02 18
sum (xor) ( H_16 (x) ( len(A) || len(C) ) ):
00000:   73 CE F4 4B AE 6B DB 61

Tag T:
00000:   A7 92 80 69 AA 10 FD 10
]]>
                    </artwork>
                </figure>
            </t>

             <t>
                 <figure>
                     <artwork>
                         <![CDATA[
-------------------------Example 2--------------------------
]]></sourcecode>
	  </li>
	</ol>
      </section>

      <section anchor="examplemagma2">
	<name>Example 2</name>
        <sourcecode><![CDATA[
Encryption key K:
00000:   99 AA BB CC DD EE FF 00 11 22 33 44 55 66 77 FE
00010:   DC BA 98 76 54 32 10 01 23 45 67 89 AB CD EF 88

ICN:
00000:   00 77 66 55 44 33 22 11

Associated authenticated data A:
00000:

Plaintext P:
00000:   22 33 44 55 66 77 00 FF

1. Encryption step:
]]></sourcecode>
	<ol>
	  <li><t>Encryption step:</t>
	  <sourcecode><![CDATA[
0^1 || ICN:
00000:   00 77 66 55 44 33 22 11

Y_1:
00000:   5B 2A 7E 60 4F 9F BB 95
E_K(Y_1):
00000:   48 A6 A5 17 0D 52 9D B1

C:
00000:   6A 95 E1 42 6B 25 9D 4E

2. Padding step:
]]></sourcecode>
	  </li>
	  <li><t>Padding step:</t>
 <sourcecode><![CDATA[
A_1 || ... || A_h:
00000:

C_1 || ... || C_q:
00000:   6A 95 E1 42 6B 25 9D 4E

3. Authentication
]]></sourcecode>
	  </li>

<li><t>Authentication tag T generation step: step:</t>
 <sourcecode><![CDATA[
1^1 || ICN:
00000:   80 77 66 55 44 33 22 11

Z_1:
00000:   59 73 54 78 7E 52 E6 EB
H_1:
00000:   EC E3 F9 DA 11 8C 7D 95
current sum:
00000:   25 D0 E4 20 7B 6B F6 3D

Z_2:
00000:   59 73 54 79 7E 52 E6 EB
H_2:
00000:   31 0C 0D AC C9 D0 4D 93
len(A) || len(C):
00000:   00 00 00 00 00 00 00 40
sum (xor) ( H_2 (x) ( len(A) || len(C) ) ):
00000:   66 D3 8F 12 0F 78 92 49

Tag T:
00000:   33 4E E2 70 45 0B EC 9E
]]>
                     </artwork>
                 </figure>
             </t>
]]></sourcecode>
</li>
	</ol>
      </section>
      </section>
    </section>
    <section anchor="contributors" title="Contributors">
            <t>
                <list style="symbols">
                    <t>
                        Evgeny Alekseev <vspace/>
                        CryptoPro <vspace/>
                        alekseev@cryptopro.ru
                    </t>
                    <t>
                        Alexandra Babueva <vspace/>
                        CryptoPro <vspace/>
                        babueva@cryptopro.ru
                    </t>
                    <t>
                        Lilia Akhmetzyanova <vspace />
                        CryptoPro<vspace />
                        lah@cryptopro.ru
                    </t>
                    <t>
                        Grigory Marshalko<vspace />
                        TC 26<vspace />
                        marshalko_gb@tc26.ru
                    </t>
                    <t>
                        Vladimir Rudskoy<vspace />
                        TC 26<vspace />
                        rudskoy_vi@tc26.ru
                    </t>
                    <t>
                        Alexey Nesterenko <vspace />
                        National numbered="false" toc="default">
      <name>Contributors</name>

     <contact fullname="Evgeny Alekseev">
       <organization>CryptoPro</organization>
       <address>
	 <email>alekseev@cryptopro.ru</email>
       </address>
     </contact>

     <contact fullname="Alexandra Babueva">

     <organization>CryptoPro</organization>
          <address>
     <email>babueva@cryptopro.ru</email>
          </address>
	    </contact>

      <contact fullname="Lilia Akhmetzyanova">

     <organization>CryptoPro</organization>
       <address>
       <email>lah@cryptopro.ru</email>
       </address>
         </contact>

       <contact fullname="Grigory Marshalko">

     <organization>TC 26</organization>
       <address>
       <email>marshalko_gb@tc26.ru</email>
       </address>
         </contact>

       <contact fullname="Vladimir Rudskoy">

      <organization>TC 26</organization>
       <address>
       <email>rudskoy_vi@tc26.ru</email>
       </address>
         </contact>

      <contact fullname="Alexey Nesterenko">

      <organization>National Research University Higher School of Economics<vspace />
                        anesterenko@hse.ru
                    </t>
                    <t>
                        Lidia Nikiforova<vspace/>
                        CryptoPro<vspace />
                        nikiforova@cryptopro.ru
                    </t>
                </list>
            </t>
        </section>
        <!--
        <section title="Acknowledgments">
            <t>
              We thank TODO for their useful comments.
            </t> Economics</organization>
       <address>
       <email>anesterenko@hse.ru</email>
       </address>
         </contact>

      <contact fullname="Lidia Nikiforova">

      <organization>CryptoPro</organization>
       <address>
       <email>nikiforova@cryptopro.ru</email>
       </address>
         </contact>

    </section>
        -->

    </back>
</rfc>