Re: [Cfrg] RGLC on draft-irtf-cfrg-chacha20-poly1305-01.txt

[Ted Krovetz <[e-mail]>]

> [*] I too think 2^32 blocks is not a large amount of data.

If one views the chacha core as a PRF from 384 bits to 512 bits, then there are all sorts of ways to increase the lengths of the internal counter and/or external nonce. Here are a couple different data layouts for chacha core input that would allow longer counters.

You could shorten the key:

  224 bits of key ||
  96 bits of nonce ||
  64 bits of counter

Or, you could mix the key and nonce (allowing 16 byte nonces):

  first 192 bits of key ||
  ((last 64 bits of key) xor (first 64 bits of nonce)) ||
  last 64 bits of nonce ||
  64 bits of counter

If one uses only the "last 64 bits of nonce", this second suggestion becomes chacha as originally specified.

-Ted