Re: [TLS] chacha/poly state?

[Watson Ladd <[e-mail]>]

On Apr 28, 2014 2:01 AM, "Yoav Nir" <[e-mail]> wrote:
>
>
> On Apr 28, 2014, at 10:23 AM, Nikos Mavrogiannopoulos <[e-mail]> wrote:
>
> > On Fri, 2014-04-25 at 09:27 -0400, Salz, Rich wrote:
> >> What’s the current state of the Cha-Cha/Poly document?  Do things need
> >> changing, identifiers assigned, or what?
> >
> > We have submitted our proposal [0] based on the new chacha construction.
> > It is up to the chairs to ask for WG adoption.
> >
> > [0]. http://tools.ietf.org/html/draft-mavrogiannopoulos-chacha-tls-02
>
> The chacha in TLS draft depends on draft-nir-cfrg-chacha20-poly1305.
>
> That still has to go through three “stages”:
>
>  1. I need to add a bunch of test vectors and an explanation of decryption. Shouldn’t be too difficult with a counter/streamish cipher such as ChaCha
>
>  2. We need to get a review of it. The changes to ChaCha are minor and do not affect security (IMO), but that’s just me. If we can get DJB to review it and say it’s OK - so much the better

So the changes were relabeling some words as counter and others as
nonce, in a different way from ChaCha? I think if you can tell that
from a PRF, you can tell the original ChaCha from a PRF, because we
have an injection into the original input state.

Sincerely,
Watson Ladd