SIV Mode: Nonce-Misuse Resistant AEAD

CTR-mode based AEAD ciphers like AES-GCM require a unique nonce for every encryption. If the same nonce is reused with the same key, an attacker who observes two ciphertexts can XOR them together to recover the XOR of the two plaintexts, immediately breaking confidentiality.

Nonce reuse in AES-GCM is even more catastrophic than in plain CTR mode. When two messages are encrypted under the same nonce and key, an attacker can recover the GHASH authentication key H entirely. With H known, the attacker can forge arbitrary authenticated messages.

Synthetic IV (SIV) mode, defined in RFC 5297, was designed to eliminate nonce reuse vulnerabilities. Instead of requiring a random or counter-based nonce, SIV derives the IV synthetically from the plaintext itself using a pseudorandom function, making it deterministic and nonce-misuse resistant.

In SIV, the nonce (called the synthetic IV) is computed as SIV = PRF(key, plaintext, associated_data). This IV is then used as the counter for CTR-mode encryption. Because the IV is derived from the plaintext, encrypting the same plaintext always produces the same ciphertext.

If a nonce is reused in SIV because the same plaintext is encrypted twice, an observer learns only that two identical messages were sent. The plaintext content itself remains hidden. This is a dramatic improvement over CTR-based AEAD where nonce reuse reveals plaintext XOR.

AES-SIV (RFC 5297) uses the S2V function (a chained PRF based on AES-CMAC) to generate the synthetic IV, followed by AES-CTR encryption keyed with a second subkey. It requires two AES keys, making key management slightly more complex than single-key AEAD modes.

AES-GCM-SIV (RFC 8452) is a more efficient nonce-misuse resistant AEAD designed to combine GCM performance with SIV-like safety. It derives per-message subkeys from the nonce and uses a Polyval authenticator, achieving better performance than AES-SIV while maintaining nonce-misuse resistance.

SIV requires two passes over the data: one to compute the synthetic IV and one for encryption. This approximately doubles the computational cost compared to single-pass AEAD modes like AES-GCM. For latency-sensitive or high-throughput applications, this overhead must be considered.

SIV is preferred when nonce generation is unreliable, when the application is stateless and cannot maintain a nonce counter, or when deterministic encryption is a requirement. Examples include encryption of database fields where the same value should always produce the same ciphertext for indexing purposes.

Stateless microservices that cannot coordinate nonce state across replicas are prime candidates for SIV mode. Rather than risking accidental nonce reuse through a global counter, SIV provides safety automatically. Key wrapping (RFC 3394) also uses SIV principles for deterministic key encryption.

AES-SIV is available in major cryptographic libraries including libsodium (as crypto_aead_aes256gcm_siv in recent versions) and Google Tink. AES-GCM-SIV is supported in BoringSSL and Go standard library. When nonce management is difficult, these are safer defaults than standard AES-GCM.

What happens when the same key is used to encrypt the same plaintext twice with AES-SIV?

SIV mode eliminates nonce reuse catastrophes by deriving the IV from the plaintext itself. Nonce reuse reveals only that identical messages were sent, not their content. AES-GCM-SIV (RFC 8452) provides efficient nonce-misuse resistance for modern applications where stateless or deterministic encryption is needed.