Re: [Cfrg] Fwd: Mail regarding draft-irtf-cfrg-chacha20-poly1305

[Ilari Liusvaara <[e-mail]>]

On Fri, Oct 17, 2014 at 07:25:43PM +0300, Yoav Nir wrote:
> Message from David Black:
> 
> > This nonce reuse warning in Section 4 somewhat on the light side:
> > 
> >   Consequences of repeating a nonce: If a nonce is repeated, then both
> >   the one-time Poly1305 key and the key-stream are identical between
> >   the messages.  This reveals the XOR of the plaintexts, because the
> >   XOR of the plaintexts is equal to the XOR of the ciphertexts.

This is missing the fact that attacker can also generate forgeries for
the (key,nonce) that was repeated.

That can actually matter, if attacker can also blackhole messages or if
recipient does not do nonce-based replay detection.

> > Here's some blunter text that could be used as a model - this was driven
> > into RFC 7146 by the secdir reviewer (it applies to all stream ciphers
> > and all modes that behave like stream ciphers):
> > 
> >   Of particular interest are the security considerations concerning the
> >   use of AES GCM [RFC4106] and AES GMAC [RFC4543]; both modes are
> >   vulnerable to catastrophic forgery attacks if a nonce is ever
> >   repeated with a given key.

Because AES-GCM equivalent to Poly1305 r depends only on key, any nonce
repeat will compromise the authenticity for the whole key in catastrophic
way.

Whereas Chacha20-Poly1305 has r depend on both key and nonce, somewhat
limiting the impact (but it is still bad).


-Ilari