Adding SIV mode for AES

[TheLazzziest]

Hi, I haven't found SIV mode in cryptography. Will you plan to add it ?
The main reason is that I am looking for a deterministic encryption(DAE) in order to store data securely and predictably in order to be able to retrieve information using some sort of a secret.

[reaperhulk]

Yes we would like to add this. Unfortunately OpenSSL has only added SIV mode in 3.0, which is not yet out. We could implement this ourselves, but we prefer to keep implementations like that within OpenSSL where possible. So you can expect to see support shortly after 3.0 is released!

[tasket]

Hello: My suggestion would be to implement the GCM-SIV mode which is faster because its based on GCM and it addresses the same issue of accidental nonce-reuse that SIV does...

https://datatracker.ietf.org/doc/rfc8452/

https://eprint.iacr.org/2017/168.pdf

[reaperhulk]

OpenSSL unfortunately hasn't implemented GCM-SIV so we can't add support for it until they do.

[beldmit]

openssl/openssl#16721 is the OpenSSL upstream issue

[alex]

implemented in #7029