Re: [TLS] Salsa20 and Poly1305 in TLS

Considering the similarity between Salsa and Chacha design & construction (and the amount of analysis that went into it), IMHO Chacha advantages justify its use over Salsa.

Thanks!
--
Regards,
Uri Blumenthal                            Voice: (781) 981-1638
Cyber Systems and Technology   Fax:   (781) 981-0186
MIT Lincoln Laboratory                Cell:  (339) 223-5363
244 Wood Street                        Email: <uri@ll.mit.edu>
Lexington, MA  02420-9185       

Web:  http://www.ll.mit.edu/CST/

MIT LL Root CA: 

 <https://www.ll.mit.edu/labcertificateauthority.html>

DSN:   478-5980 ask Lincoln ext.1638

----- Original Message -----
From: Simon Josefsson [mailto:simon@josefsson.org]
Sent: Sunday, August 11, 2013 06:18 PM
To: Ted Krovetz <ted@krovetz.net>
Cc: tls@ietf.org <tls@ietf.org>
Subject: Re: [TLS] Salsa20 and Poly1305 in TLS

Ted Krovetz <ted@krovetz.net> writes:

> I'd also suggest using Bernstein's Chacha instead of Bernstein's
> Salsa. It has the same core as Salsa, but Bernstein cleaned up the
> rough edges of its prolog and epilog, making it smaller, faster and
> nicer to program. Chacha is basically a better Salsa.
>
> http://cr.yp.to/chacha.html

Right, there is a bunch of stream ciphers that have nicer properties
than Salsa20, but Salsa20 was chosen conservatively from the set of
modern stream cipher.  Do you think the benefits of Chacha motivate
ignoring the time that went into reviewing Salsa20?  I'm assuming
Salsa20 has received more review than Chacha, but I cannot quantify it.

I would have prefered a stream cipher with builtin authentication, so we
wouldn't have to debate the choice of MAC.  Alas, I'm not aware of any
with good performance that has gone through significant review.

/Simon
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls