[Cfrg] ChaCha20 and Poly1305 for IPsec

[Yoav Nir <[e-mail]>]

Hi

Recently there has been some activity in trying to find alternative ciphers. In TLS the issue was RC4, which is now deemed insecure. Adam's draft ([1]) proposes to use another stream cipher, ChaCha20, in its place. Poly1305 is used in that draft as a faster (when compared with HMAC-SHA1) message authentication algorithm. 

For IPsec, RC4 was never used because it always produces the same keystream, so we cannot produce per-packet streams. What we have today is that the only widely-deployed algorithm other than AES is 3DES, and on modern hardware AES is 4x to 10x as fast as 3DES. That means that if ever an issue is found in AES, users will not be able to switch to 3DES - the performance is not even close, so much of the deployed hardware will not be able to handle the load. This sorry state is described in [2].

Unlike RC4, ChaCha20 has a 64-bit nonce, so different packets could use different keystreams, much like block ciphers in counter mode. Unlike 3DES, ChaCha20 has performance that is close to that of AES.

So my question is whether there is any reason not to use ChaCha20 (with or without the AEAD construction from Adam's draft) for IKE and/or IPsec. Could this be the standby algorithm that we have been looking for?

Yoav

[1] http://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-04
[2] http://tools.ietf.org/html/draft-mcgrew-standby-cipher-00