Re: [TLS] chacha to replace RC4 (was: Salsa vs. ChaCha)

[Nikos Mavrogiannopoulos <[e-mail]>]

On Fri, 2013-12-06 at 10:21 -0500, Nick Mathewson wrote:

> The issue is that most implementations (all the ones I've seen,
> actually, and Robert has probably looked at more than I have) have an
> interface where you specify the number of bytes of output up front,
> and generate.  They do not have an incremental "generate the next N
> bytes of the stream" function.
> 
> That said, it's pretty trivial to adopt _any_ of the implementations
> I've seen so that they would run incrementally; it's not a difficult
> programming problem.  You'd need to add 512 bits of memory overhead
> for each chacha instance, and you'd take a little performance overhead
> from the bookkeeping, but that's not a huge deal.

I also think so.

> And *that* said, it's also trivial to avoid the need to make any such
> change, by taking the strategy Adam's draft does, and using a
> different nonce for each record.

A different nonce for each record is mandatory if chacha or salsa20 are
to be used with DTLS. This has been the case from the first draft we had
in salsa20. So I think the previous comment is not applicable to the
draft I posted.

regards,
Nikos