Re: [Cfrg] AEAD outputs and RFC 7539 (ChaCha20-Poly1305)

[Adam Langley <[e-mail]>]

On Mon, May 23, 2016 at 2:45 PM, Martin Thomson
<[e-mail]> wrote:
> https://tools.ietf.org/html/rfc7539#section-2.8 says:
>
>    The output from the AEAD is twofold:
>
>    o  A ciphertext of the same length as the plaintext.
>    o  A 128-bit tag, which is the output of the Poly1305 function.
>
> However, https://tools.ietf.org/html/rfc5116#section-2.1, which
> defines the interface says this:
>
>    There is a single output:
>
>       A ciphertext C, which is at least as long as the plaintext, or
>
>       an indication that the requested encryption operation could not be
>       performed.
>
> And later makes it clear that C includes the authentication tag by noting that:
>
>    An AEAD_AES_128_GCM ciphertext is exactly 16 octets longer than its
>    corresponding plaintext.
>
> This suggests to me that there is an erratum to be raised.  amirite?

I favour the model of RFC5116, but it's not universal. There are
certainly cases where the separate parts are used, for example when
encrypting in place and storing tags out of band.


Cheers

AGL

-- 
Adam Langley [e-mail] https://www.imperialviolet.org