Re: [Cfrg] RGLC on draft-irtf-cfrg-chacha20-poly1305-01.txt

[Yoav Nir <[e-mail]>]

On Oct 2, 2014, at 3:45 PM, Alexey Melnikov <[e-mail]> wrote:

> The authors of "ChaCha20 and Poly1305 for IETF protocols", draft-irtf-cfrg-chacha20-poly1305-01.txt believe the draft is ready for a RGLC.
> 
> This starts a two week research group last call, to end on 17 Oct 2014.
> 
> The draft is available at http://datatracker.ietf.org/doc/draft-irtf-cfrg-chacha20-poly1305/
> 
> Please do comment on the list, indicating whether you believe this draft is ready for publication. Please send your comments, indication of support for the publication or objections to the publication to the mailing list or directly to the RG chairs ([e-mail]).
> 
> Alexey,
> As a co-chair.

Hi.

I haven’t submitted anything yet, but I’ve made a few changes to my local copy:
I’ve added the AEAD parameters from RFC 5116.
I’ve added the sentence suggested by Dan Harkins about combining several chunks of associated data (pretty much passing the responsibility for assembly/reassembly to the application)
I’ve changed the worked example for quarter-round, as suggested by Sean Parkinson (chose an example with the rotate-left amount not 16, because a rotate-left of 16 bits is similar to rotate-right of 16 bits)
I’ve added pseudo-code “implementations” to some of the algorithms, as suggested by Sean Parkinson

Things I didn’t do:
I did not change the counter/nonce split back to 64/64 as James Cloos suggested, because (a) that’s against a SHOULD in RFC 5116, and (b) it’s useful for multi-sender protocols, and (c) we had consensus for the change, and I don’t think we have consensus for the change back.
I did not switch to XChaCha as suggested by David Leon Gil
I did not incorporate the test vectors suggested by David because (a) they depend on suggested changes to hot the counter/nonce split, and (b) it might be addressed by limiting the amount of data that is allowed to be encrypted, which is in the draft (unless I totally misunderstood the suggestion)

For the (unpublished) draft with the changes, see:
 - TXT version: https://docs.google.com/document/d/1FnL6L_Ce_fnlqeRxSdoEUCbBQzz4m8r9ciy1dH9toC8/pub
 - HTML-ized version: https://docs.google.com/document/d/1SSICS0HBl0lot1hZJ8-XT7Q6JVJr9b0zQ6ZZUH4D-B0/pub

Yoav