Re: [IPsec] Two questions about draft-ietf-ipsecme-chacha20-poly1305-00

"Scott Fluhrer (sfluhrer)" <> Mon, 30 March 2015 17:42 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 579BF1A907A; Mon, 30 Mar 2015 10:42:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -14.511
X-Spam-Status: No, score=-14.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id FFa1UzXFpkH1; Mon, 30 Mar 2015 10:42:29 -0700 (PDT)
Received: from ( []) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id B7D581A9068; Mon, 30 Mar 2015 10:42:28 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;;; l=3108; q=dns/txt; s=iport; t=1427737349; x=1428946949; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=Rj/ivOqOpnlFiO5vp5zmv8u5jMculqouFF3Aefn6/EY=; b=PL7DCyj6KY8Gr5RnQT7U2oaFvV3vmryOvHNldKJylnPvaLOeTZF9RIX7 Ds6UafFk8Hu5BcoKjZAqpC6SZvNQ3KakbYF0r8cNNBiG5UoLaT0s/y8Lp 6siJEB7bYVJ60AQyPhBJsMRufXjQ2+In1VFrgJLJ9rEqA7s7oYc2JESKL 0=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-AV: E=Sophos;i="5.11,495,1422921600"; d="scan'208";a="136697522"
Received: from ([]) by with ESMTP; 30 Mar 2015 17:42:28 +0000
Received: from ( []) by (8.14.5/8.14.5) with ESMTP id t2UHgRnK001598 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Mon, 30 Mar 2015 17:42:27 GMT
Received: from ([]) by ([]) with mapi id 14.03.0195.001; Mon, 30 Mar 2015 12:42:27 -0500
From: "Scott Fluhrer (sfluhrer)" <>
To: Yoav Nir <>, "" <>
Thread-Topic: [IPsec] Two questions about draft-ietf-ipsecme-chacha20-poly1305-00
Thread-Index: AQHQavdqfbVtITbEkkWmolKMjGVLV501RvGA
Date: Mon, 30 Mar 2015 17:42:27 +0000
Message-ID: <>
References: <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-originating-ip: []
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <>
Cc: "" <>, "" <>
Subject: Re: [IPsec] Two questions about draft-ietf-ipsecme-chacha20-poly1305-00
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Discussion of IPsec protocols <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 30 Mar 2015 17:42:30 -0000

-----Original Message-----
From: IPsec [] On Behalf Of Yoav Nir
Sent: Monday, March 30, 2015 10:40 AM
Subject: [IPsec] Two questions about draft-ietf-ipsecme-chacha20-poly1305-00

> Hi,
> There is two questions I would like guidance from the group about.
> First is the nonce/IV question: In the current draft, there is a 64-bit IV with guidance not to repeat them (so use a counter or LFSR). The function itself accepts a 96-bit input nonce, so the nonce is constructed from the 64-bit IV and 32 zero bits. The reason for doing this is so the algorithm could be used in a multi-sender case such as GDOI, where the 32-bit zero can be replaced by a sender ID. 

This idea about the multi-sender case works only if the there's a sender id somewhere in the encrypted packet.

> Alternatively, we could generate a 32-bit salt value from the key material, but I don’t see a reason why we’d want that.

Here's the reason that we do use the 32-bit salt value for GCM - to prevent batching attacks.

Consider the case that an attacker is able to collect packets from a billion (2^30) sessions; each such session contains a packet with the same IV (say, IV=0), and contains a packet with the same known plaintext (or, at least, plaintext that satisfies the same known linear equations).  Then, what an attacker can do is check a key to see if any of the IV=0 packets used that key, in constant time.  The reduces the effort for an attacker to find the n bit key for some session from 2^n to 2^{n-30}.  What the salt does is multiply the effort involved in this specific attack by a factor of 2^32 (because the attacker needs to guess the key and the salt); that way, the attacker needs to collect 4 billion sessions before this attack starts to have any advantage over a simpler attack that just attacks a single packet (which the salt doesn’t protect against).

Now, of course, chacha20 has 256 bit keys; hence even if we decided not to apply the same protection, someone with a collection of a billion sessions might be able to use this to reduce the effort to 2^226.

I'll let you decide whether this is a compelling argument or not...