Re: [Cfrg] Poly1305 and timing attacks

On Mar 9, 2014, at 6:45 PM, Watson Ladd <watsonbladd@gmail.com> wrote:

> 
> An implementation of Poly1305 that isn't constant time imposes a
> significant additional burden on callers to generate the entire key
> pseudorandomly, as opposed to changing the last part. In the AEAD or
> MAC as defined here that's okay.

Understood.

> The place where Poly1305 leaks information is likely in the polynomial
> evaluation. It is acceptable to have (r, s1), (r, s2) ... with r
> unchanging and the s generated pseudorandomly. But in an
> implementation which isn't constant time could eventually reveal r
> over multiple messages.

Agree. However, from what I have heard in both the IPsec and TLS working groups, there is little to no interest in the stand-alone versions of chacha20 and poly1305, only the AEAD combination, So I might divide the security considerations into stuff that is for poly1305 stand-alone, and other considerations for the AEAD, which can possibly be less onerous.

> For Poly1305 as used in this draft, I am very, very hesitant about
> approving any draft that says not-constant time is okay. However, if
> the entire keys are being generated pseudorandomly, then I think, if
> the side channel isn't gratuitously large, it's possibly safe. Saying
> anything more concrete would require a lot of painful analysis of what
> is leaked and how it can be used.
> 
> Personally, I don't understand why making the crypto not constant
> time, and thus open to attacks, simplifies the security
> considerations. It might make the job of the implementor easier, but
> it makes the job of the person who builds on top harder.

It makes the security considerations simpler because it makes all the talk about constant time implementations go away and eliminates the need for pointing people at how to accomplish this. I agree I probably can’t do this, as this implementation might later be used as part of a library for other things. It’s not generally good to instruct people on how to make an implementation with a warning label (that they will later ignore).

> Two sidenotes: IVs are not nonces, and there is a typo where "times
> might be great then 2^256 or less then 2^256”.

Yes, “sometimes” is a single word. 

> Sincerely,
> Watson Ladd
>> 
>> Thanks
>> 
>> Yoav
>> 
>> 
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> http://www.irtf.org/mailman/listinfo/cfrg
>> 
> 
> 
> 
> -- 
> "Those who would give up Essential Liberty to purchase a little
> Temporary Safety deserve neither  Liberty nor Safety."
> -- Benjamin Franklin