Re: [Cfrg] [RFC] [DRAFT] eXtended-nonce ChaCha and AEAD_XChaCha20-Poly1305 (updated)

[Scott Arciszewski <[e-mail]>]

Hi David,

Why not define it as a randomized AEAD algorithm, so that the nonce is
> dispensed with entirely?


I actually do precisely that in my high-level abstractions that wrap
libsodium's crypto_aead_xchacha20poly1305_*(). See the PASETO draft for
example.

However, the API provided by the incumbent implementations do not force
developers to use random nonces. It wouldn't be good form for me to add
this requirement.

This RFC draft captures what existing implementations have already been
doing for years.

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com>


On Fri, Oct 12, 2018 at 9:26 AM David McGrew (mcgrew) <[e-mail]>
wrote:

> Hi Scott,
>
> it’s nice to see work that creates alternatives to deterministic nonces.
>
> As I understand it, the motivation for this draft is to enable the use of
> random nonces.  Why not define it as a randomized AEAD algorithm, so that
> the nonce is dispensed with entirely?   (In  RFC 5116 terms, a randomized
> algorithm can have a maximum nonce length of zero).    That way, the
> security of the algorithm does not depend on the user’s ability to provide
> random nonces, there is no need to document the security requirements (or
> any other requirements) around that input, and the nonce generation can be
> tested along with the algorithm.
>
> A couple of other comments: there needs to be a security considerations
> section (especially if guidance on nonce generation is needed) and there
> should be an IANA section that creates registry entries for this algorithm.
>
>
> If nonces are pseudorandomly generated, either inside or outside of the
> algorithm, then users need to be careful about things like fork() and VM
> cloning that can undermine security by causing unintentional nonce reuse.
>
> best
>
> David
>
> From: Cfrg <[e-mail]> on behalf of Paragon Initiative
> Enterprises Security Team <[e-mail]>
> Date: Friday, October 5, 2018 at 1:36 PM
> To: "[e-mail]" <[e-mail]>
> Subject: [Cfrg] [RFC] [DRAFT] eXtended-nonce ChaCha and
> AEAD_XChaCha20-Poly1305 (updated)
>
> Good afternoon,
>
> I've uploaded draft01, which contains some typo fixes and an additional
> test vector for XChaCha20 directly.
>
> https://datatracker.ietf.org/doc/draft-arciszewski-xchacha/
>
> If anyone would like to contribute to this document directly, its
> development is being facilitated on GitHub:
> https://github.com/bikeshedders/xchacha-rfc
>
> Of course, I'm also open to feedback/criticism via email as well.
>
> Scott Arciszewski
> Chief Development Officer
> Paragon Initiative Enterprises <https://paragonie.com>
>
>