Re: [Cfrg] ChaCha20 and Poly1305 for IPsec

On Jan 21, 2014 12:59 PM, "Yoav Nir" <ynir@checkpoint.com> wrote:
>
>
> On Jan 21, 2014, at 8:06 PM, Adam Langley <agl@google.com> wrote:
>
> > On Tue, Jan 21, 2014 at 11:47 AM, Yoav Nir <ynir@checkpoint.com> wrote:
> >> Reviews and comments would be greatly appreciated, as well as anyone
checking my examples.
> >
> > In the introduction: I think ChaCha20+Poly1305 are useful for software
> > implementations, beyond their use as a backup to AES. AES in not
> > suitable for pure, software implementations and they tend to be be
> > slow and have side-channels. (AES-GCM even more so.)
>
> I agree that a pure C-language implementation of AES is slower than
either ChaCha20 or RC4, although it is still much faster than 3DES.
Processor vendors have been adding hardware implementation of common tasks
to so-called general purpose processors for years. So we got floating point
in the late 80s, and "multi-media extension" 128-bit registers in the 90s,
then vector processors, and now encryption functions. Is software that uses
the AESENC opcode software or hardware? I think by now the line is blurred.
For IPsec, AES has been the fastest algorithm even in pure C
implementations.  I'll add something about being fast in software
implementation to the next iteration.
>
> > "The ChaCha20 block function"...
> >
> > I asked DJB and he said that ChaCha is the name of the cipher and
> > ChaCha20 is the specific variant with 20 rounds.
>
> Yeah, that's how I used it.
>
> >
> > "The 14th word is the least significant 32 bits of the input nonce
> > (nonce | 0xffffffff)"
> >
> > AND not OR, I think.
>
> Oops. You're right, of course.
>
> > You've changed the AEAD by switching the length values from uint64le
> > to uint32be. Seems unnecessary.
>
> I'll change it back. For some reason I thought AES-GCM for IPsec was like
that, but looking again, I see that it isn't.
>
> >
> > "for a particular key. counters"
> >
> > nit: missing capital letter.
>
> Will fix. Thanks.
>
> > I'm not suitable to evaluate the higher-level integration into IPSec.
> >
>
> I've posted this to ipsec as well. They said that we need a better
normative reference for the functions. DJB's papers discuss security
properties and link to source code, but don't have a good definition.
>

Are you reading the same paper I am? He defines Salsa and ChaCha in terms
of applying a well defined quarter round function to the rows and diagonals
of a 4x4 matrix.

> Yoav
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg