[Cfrg] Poly1305 and timing attacks

[Yoav Nir <[e-mail]>]

Hi

I mentioned this during the meeting, but there was no discussion on this
subject there, so I thought I'd raise it here.

I got a private message in response to draft-nir-cfrg-chacha20-poly1305
that questions the text about constant time implementations for Poly1305.
The argument can be outlined as follows:

Side channels in general and timing vulnerabilities in particular are bad
because they reveal either parts of the plaintext they work on, or parts of
the key that is used. However, Poly1305 works on the ciphertext that is
sent on the wire anyway, so exposing that does not matter. Also, Poly1305
requires a different one-time key for each invocation, so revealing some
information about that one-time key doesn't matter, because it will not be
used again. So in summary, timing attacks on Poly1305 don't matter.

This argument is very attractive to me, because if it is valid, it makes
the security considerations much simpler, and significantly reduces the
complexity of implementing these algorithms (the "competent" vs "good"
coder from slide 2).

So can anyone on this list comment on this argument?

Thanks

Yoav