Close to Optimally Secure Variants of GCM

Table 2

Comparison of AE schemes that provide BBB security. “” means can be reduced to . “n.r.” denotes nonce-respecting and “n.m.” denotes nonce-misuse. “PRP” stands for pseudorandom permutation, “TPRP” stands for tweakable PRP, and “PRF” stands for pseudorandom function. Let be the block length of the plaintext and be the block length of associated data. Let be two integers. Let stand for approximately equal to. For example, ≃128 means that it is approximately equal to 128.

	CHM	GCM-SIVr	OGCM-1	OGCM-2	SCT	SIVx	RWCTRN
# keys	1				1	1
Nonce scenario	n.r.	n.m.	n.r.	n.r.	n.m.	n.m.	n.r.
Assumption	PRP	PRP	PRP	PRP	TPRP	TPRP	PRF
Block size	128	128	128	128	128	128	256
Security (bits)	85.3333				≃128	≃128	248
# primitive Calls
# multiplications					0	0
Reference	[30]	[32]	This paper	This paper	[12]	[11]	[47]