Re: [Cfrg] RGLC on draft-irtf-cfrg-chacha20-poly1305-01.txt

[James Cloos <[e-mail]>]

>>>>> "MP" == Manuel Pégourié-Gonnard <[e-mail]> writes:

MP> ... if each block is treated separately, then why do you need a
MP> counter larger than 32 bits?

The counter increments for each 256bit block.

I'd expect two block sizes; the 256-bit chacha block and some arbitrary,
potentially larger poly1305 block, perhaps covering somewhere between 4
and 256 chacha blocks.

Each 256bit block gets its own counter value.

Each poly1305 block is vulnerable to loss due to corruption.  Although
even then it can be analyzed to attempt to recover as many bits as
possible --- since it is not on-the-fly, time is available to let people
make judgement calls.

Which reminds me of something I forgot to mention in this thread.

I'd also prefer to see three RFCs.  One covering chacha itself
(including each of two, three or five quad-rounds[sic]), one for
poly1305 (including with chacha and aes (it's original spec)),
and the combination, referecing the first two.

Chacha on its own has value, too.

Dan's paper on aes/poly1305 makes it look like a better choice than gcm,
at least.  Maybe also better than ccm, et alia.

And then the third can be specific to on-the-fly.

-JimC
-- 
James Cloos <[e-mail]>         OpenPGP: 0x997A9F17ED7DAEA6