Re: [TLS] Comments on draft-nir-cfrg-chacha20-poly1305-02

[[e-mail] (Niels Möller )]

Adam Langley <[e-mail]> writes:

>> In section 2.4.2, the test vector for the chacha20 cipher, I think it
>> would be good to have an example with initial counter = 0. I think
>> that's going to be the typical case when using chacha as cipher only.
>
> The draft defines an AEAD so I think it's ok that the examples are
> focused on that.

Now I see that there are additional test vectors in appendix A.2, that's
nice, sorry I missed that initially. But I think it would be valuable to
add a test vector with a non-zero nonce, say 01 02 03 04 05 06 07 08 09
0a 0b 0c, a non-zero key, and a zero initial counter, and two blocks of
data. That should test for most of the formatting pitfalls with a single
test-case for the most basic encryption interface, without
random-access-features.

>> In section 2.8.2, the nonce is given in two pieces, an "IV" and a
>> "32-bit fixed common part". It's not crystal clear how to put then
>> together. Please also write out the complete 12-byte nonce explicitly.
>
> It does seem that this section might be a little IPSec focused. The
> nonce is called an nonce elsewhere in the draft, but is given as an
> "IV" and "fixed-common part" here, but those terms are never used
> elsewhere. Possibly they should be merged and called an nonce,
> although I'm sure that Yoav will decide what's best here.

I think that division can also be found in RFC 5116, but I think it's
important that it's crystal clear what the inputs are. It's fine to list
both the pieces and the combined 12-byte nonce, if you think the
division is important.

Regards,
/Niels

-- 
Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26.
Internet email is subject to wholesale government surveillance.