[TLS] Comments on

[[e-mail] (Niels Möller )]

Hi,

I have a couple of comments on
https://datatracker.ietf.org/doc/draft-agl-tls-chacha20poly1305/?include_text=1
I hope cc:ing the tls ietf list is appropriate (I'm not involved in this
wg).

1. It would be nice with a couple of additional test cases for
   AEAD_CHACHA20_POLY1305. In particular for the corner cases of empty
   associated data and/or empty plaintext.

2. The input to the poly1305mac is defined as

     ad | length(ad) | cryptotext | length(cryptotext)

   As far as I understand, this is a bit redundant, since the second
   length field is sufficient to make the encoding injective. Does using
   two length fields increase security in some subtle way?

   At least in my implementantation, the length(ad) field causes some
   additional complexity, so

     ad | cryptotext | length(cryptotext)

   would be preferable. I'm not sure if this draft should be read as
   proposing a new aead construction, or if it documents an algorithm
   which is already deployed; in the latter case changes like this can't
   be made easily, of course.

3. Do you think reduced round variants of chacha make sense? If not,
   the name "chacha-poly1305" is nicer than "chacha20-poly1305".

Regards,
/Niels

-- 
Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26.
Internet email is subject to wholesale government surveillance.