Re: [Dtls-iot] RFC 7539 (ChaCha20 and Poly1305) a SHOULD/MUST implement?

Hi Hannes:

I do not think there is any technical or practical reason to add support 
for ChaCha or Poly1305.

For very constrained devices, the required state is quite large, 
per-message key initialization cost is relatively high for short 
message, allowing starting processing of incoming packets
after computation of those per-message keys only, and ChaCha20 keys are 
256-bits. Most underlying transceivers already have AES on board, in 
hardware, and operate using 128-bit keys. Adding another mode does seem 
to impose cost, with unclear technical benefit, both on security and 
performance and implementation cost front.

On a side note: the security of Salsa20/20 has been quite well analyzed 
(see, e.g., [1]), but - to my knowledge - this has not been extended to 
ChaCha.

Best regards, Rene

[1] Ciphers - Salsa20 Secure Against Differential Cryptanalysis (Nicky 
Mouha, Bart Preneel, IACR ePrint 2013-328)

On 8/6/2015 6:00 AM, Hannes Tschofenig wrote:
> Hi all, Hi Stephen,
> I have sent the mail below to this mailing list in an attempt to 
> solicit feedback from the DICE group after creating an issue in the 
> issue tracker at http://trac.tools.ietf.org/wg/dice/trac/ticket/34
> I have also posted a message to the CFRG list, see
> http://www.ietf.org/mail-archive/web/cfrg/current/msg07082.html
> While I got a little bit of feedback on the CFRG list I am still 
> unsure about how to proceed on this topic.
> There does not seem to be strong interest in using ChaCha20 and Poly1305.
> Currently, AES is in used in hardware of many embedded/IoT systems. It 
> is also mandated in various standards, including radio technologies.
> To my knowledge there is no hardware support for ChaCha20 and Poly1305 
> in chips today.
> Requiring ChaCha20 and Poly1305 in addition to AES would be possible 
> on paper but will lead to additional flash space.
> What should we do?
> Ciao
> Hannes
> *Gesendet:* Mittwoch, 15. Juli 2015 um 13:35 Uhr
> *Von:* "Hannes Tschofenig" <hannes.tschofenig@gmx.net>
> *An:* "dtls-iot@ietf.org" <dtls-iot@ietf.org>, "Stephen Farrell" 
> <stephen.farrell@cs.tcd.ie>
> *Betreff:* [Dtls-iot] RFC 7539 (ChaCha20 and Poly1305) a SHOULD/MUST 
> implement?
> Stephen wrote:
>
> (11) 21: Why not make RFC7539 a SHOULD or MUST right now? Doesn't it
> seem like doing so now in a profile would be the right kind of timing?
> And that might be our best bet for healing the CCM/GCM rift so I'd like
> to check if the WG agree with that idea or not before we go to IETF LC.
> (That might justify a separate thread.)
>
> This is really a question for the group to think about. Any comments?
>
> _______________________________________________
> dtls-iot mailing list
> dtls-iot@ietf.org
> https://www.ietf.org/mailman/listinfo/dtls-iot
>
>
> _______________________________________________
> dtls-iot mailing list
> dtls-iot@ietf.org
> https://www.ietf.org/mailman/listinfo/dtls-iot

-- 
email: rstruik.ext@gmail.com | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363