Security of MGM about aeads

[tarcieri]

I'm personally not very familiar with it, but here's a paper:

https://eprint.iacr.org/2019/123.pdf

I think the main reason you'd use it is because it's the AEAD mode used by the GOST State Standardization System.

In general, I'd probably recommend aes-gcm, aes-gcm-siv, or chacha20poly1305.

[ethindp]

@tarcieri I similarly would use AES-GCM/AES-GCM-SIV/ChaCha20/XChaCha20. I was just wondering if MGM truly had any security benefits. The paper you linked to was the same one I found and I couldn't really get much out of it.

[newpavlov]

IIUC the mode developers claim that it has some theoretical benefits over GCM, but I think that from practical perspective resistance to nonce-misuse provided by SIV modes easily beats those, so I would also recommend to use those instead if for your use-case their performance is sufficient.