%% You should probably cite draft-gueron-cfrg-dndkgcm-04 instead of this revision.
@techreport{gueron-cfrg-dndkgcm-00,
    number =    {draft-gueron-cfrg-dndkgcm-00},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-gueron-cfrg-dndkgcm/00/},
    author =    {Shay Gueron},
    title =     {{Double Nonce Derive Key AES-GCM (DNDK-GCM)}},
    pagetotal = 28,
    year =      2024,
    month =     apr,
    day =       15,
    abstract =  {This document specifies an authenticated encryption algorithm called Double Nonce Derive Key AES-GCM (DNDK-GCM) that operates with a 32- byte root key and encrypts with a 24-byte random nonce, and optionally provides for key commitment. Encryption takes the root key and a random nonce, derives a fresh encryption key and a key commitment value, invokes AES-GCM with the derived key and a 12-byte zero nonce, and outputs the ciphertext, authentication tag and the key commitment value. The low collision probability with 24-byte random nonces extends the lifetime of the root key and this supports processing up to 2\textasciicircum{}64 bytes under one root key. DNDK-GCM involves a small overhead compared to using AES-GCM directly, and its security relies only on the standard assumption on AES as a pseudorandom permutation.},
}