Re: [Cfrg] ChaCha20 and Poly1305 for IPsec

[David McGrew <[e-mail]>]

Hi Yoav,

On 01/21/2014 04:25 PM, Yoav Nir wrote:
> On 21/1/14 11:05 PM, Watson Ladd wrote:
>>
>> >
>> > I've posted this to ipsec as well. They said that we need a better 
>> normative reference for the functions. DJB's papers discuss security 
>> properties and link to source code, but don't have a good definition.
>> >
>>
>> Are you reading the same paper I am? He defines Salsa and ChaCha in 
>> terms of applying a well defined quarter round function to the rows 
>> and diagonals of a 4x4 matrix.
>>
>
> I'm reading this one:
> http://cr.yp.to/chacha/chacha-20080128.pdf
>
> It's mixing description, comparison with Salsa20, security analysis 
> and performance data. That's fine for a paper. I could probably write 
> an implementation based on that, but I would have very little 
> confidence that it is correct.


The "spec.pdf" file in the "Design, Specification, Security and Speed" 
zipfile submitted to ESTREAM might be useful to you 
http://www.ecrypt.eu.org/stream/e2-salsa20.html

David

>
> For RFCs, we like to have a clear document that is as short as 
> possible, and has a very clear definition, and a few test vectors so 
> an implementer can check their code.
>
> I'm not totally convinced by Yaron's response ([1]), but I'd rather 
> not be forced to repeat much of the algorithm in my draft, as Adam did 
> in sections 3 & 4 of [2].
>
> Yoav
>
> [1] http://www.ietf.org/mail-archive/web/ipsec/current/msg08929.html
> [2] http://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-04
>