Re: [quicwg/base-drafts] Simplify ChaCha20 interface (#2990)

[Kazuho Oku <[e-mail]>]

kazuho commented on this pull request.



> @@ -1049,16 +1049,16 @@ function as defined in Section 2.4 of {{!CHACHA}}.  This uses a 256-bit key and
 16 bytes sampled from the packet protection output.
 
 The first 4 bytes of the sampled ciphertext are interpreted as a 32-bit number
-in little-endian order and are used as the block count.  The remaining 12 bytes
-are interpreted as three concatenated 32-bit numbers in little-endian order and
-used as the nonce.
+in little-endian order and are used as the block count; a ChaCha20
+implementation might instead take the 4 bytes as an opaque sequence of bytes.
+The remaining 12 bytes are used as the nonce.

While I like the idea of providing practical advice, I am a bit concerned of dropping the text that state the format of input in terms of specification language (in this case RFC 7539).

RFC 7539 assumes that the nonce to be three uint32 values. Is it possible to provide a formal definition without describing the interaction with that design? In practice, I think that the new text does not read good when the user is using a Chacha20 implementation (used on a big endian machine) that in fact takes uint32 values as inputs (rather than octets).

To reiterate, I think that it might be better preserve the existing text, at the same time "adding" implementation advice when using a Chacha20 function that takes octets as input.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2990#pullrequestreview-284560558