Re: [Cfrg] RGLC on draft-irtf-cfrg-chacha20-poly1305-01.txt

David Leon Gil <coruus@gmail.com> Tue, 07 October 2014 15:09 UTC

Return-Path: <coruus@gmail.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E30F91ACE06 for <cfrg@ietfa.amsl.com>; Tue, 7 Oct 2014 08:09:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i3jAPGVKEare for <cfrg@ietfa.amsl.com>; Tue, 7 Oct 2014 08:09:32 -0700 (PDT)
Received: from mail-la0-x231.google.com (mail-la0-x231.google.com [IPv6:2a00:1450:4010:c03::231]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 431071ACDFC for <cfrg@irtf.org>; Tue, 7 Oct 2014 08:09:31 -0700 (PDT)
Received: by mail-la0-f49.google.com with SMTP id q1so6608569lam.36 for <cfrg@irtf.org>; Tue, 07 Oct 2014 08:09:29 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=p8/WlJPR/mksc0TTa3LIyzozVaE87DzQ1QSoa7fcvL8=; b=bBmt7Ea/QZ2jS9gqcwOI2g6cZVgo11ISdlSHlwnDQKh2u/5r9fe2eWqhVboh7NFQcs +3Z2uRRsg87my8pXCAUzCguGNrbmUw03AXPqbKK3wTRiRMn4BhjLPmSemeX32O2NefV0 awz57J6VJZLitnAvsr7mIadPodkvTHD3NXUbWb2YawhpiMFQkqnxhGYWmY7TSvIs5PhF 5Q56/lqizZITXBtyEX9QZNfzx+XrE7EiBc7zTjsh8LQEjNQfZ8aBy/ZBxn+ZUhCfKQ7S SXNgGeYoZgOmeo1LJTUzyWI0ddLQYTEAdzuSQsPb4wqAIxgmfyQvs/h8ejoxHiduNzBa XOYQ==
X-Received: by 10.112.151.99 with SMTP id up3mr4642881lbb.45.1412694569367; Tue, 07 Oct 2014 08:09:29 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.25.218.145 with HTTP; Tue, 7 Oct 2014 08:09:09 -0700 (PDT)
In-Reply-To: <CAGvU-a7zd9jB_0vwipe4ALO5u5F0tk5BrfQ-0B5sLNjNRjZiPQ@mail.gmail.com>
References: <542D48CD.9060404@isode.com> <CAGvU-a7zd9jB_0vwipe4ALO5u5F0tk5BrfQ-0B5sLNjNRjZiPQ@mail.gmail.com>
From: David Leon Gil <coruus@gmail.com>
Date: Tue, 7 Oct 2014 11:09:09 -0400
Message-ID: <CAA7UWsUTt2ug2JGdvLfGKfoq1mFjvF40mgK-jPF569uo6CpkRA@mail.gmail.com>
To: Yoav Nir <ynir.ietf@gmail.com>
Content-Type: text/plain; charset=UTF-8
Archived-At: http://mailarchive.ietf.org/arch/msg/cfrg/FudzA3nK3-UJmIu3HH0FoAVCCXc
Cc: "cfrg@irtf.org" <cfrg@irtf.org>
Subject: Re: [Cfrg] RGLC on draft-irtf-cfrg-chacha20-poly1305-01.txt
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Tue, 07 Oct 2014 15:09:44 -0000

(This I-D is really excellent; my comments are minor nits. I support moving
this along to RFC status ASAP.)

On Mon, Oct 6, 2014 at 4:13 AM, Yoav Nir <ynir.ietf@gmail.com> wrote:
>  - At least two implementations were done by following the draft (and the
> test vectors checked out)

Re A.2: There are still no ChaCha20 test-vectors to ensure that implementations
use the correct counter rule.

I.e., what happens when the 32-bit block counter is 2^32 - 1? It is
rather critical
that implementations never reuse the keystream for block 0 in this construction.

I'd suggest, in light of the note in 2.8.1, that simply letting the counter mode
be non-separated is simplest. (This has the advantage that it retains
compatibility
with the original definition.[*])

(I have test-vectors for either option; but the authors would need to
pick one...)

--

Perhaps add a reference to the more recent paper by Namprempre et al.,
"Reconsidering generic composition" https://eprint.iacr.org/2014/206
(I believe this would be a N2-type scheme in their terminology.)

[*] I too think 2^32 blocks is not a large amount of data.