Re: [TLS] Comments on

[Adam Langley <[e-mail]>]

On Thu, Feb 13, 2014 at 5:11 AM, Niels Möller <[e-mail]> wrote:
> 1. It would be nice with a couple of additional test cases for
>    AEAD_CHACHA20_POLY1305. In particular for the corner cases of empty
>    associated data and/or empty plaintext.

Ack. Yoav pulled out the AEAD bit into
https://tools.ietf.org/html/draft-nir-cfrg-chacha20-poly1305-01 so
that it's not TLS specific and that's probably the place for this now.

> 2. The input to the poly1305mac is defined as
>
>      ad | length(ad) | cryptotext | length(cryptotext)
>
>    As far as I understand, this is a bit redundant, since the second
>    length field is sufficient to make the encoding injective. Does using
>    two length fields increase security in some subtle way?

I don't believe so, it was just habit to put a length on each piece.
(The lengths were originally prefixes of the data. wtc suggested
moving them to the end so that the AEAD could be computed without
knowing the length of the data apriori. Although this does lead to the
possibility of "streaming" APIs which I would discourage as they
release unauthenticated plaintext and force others to also.)

>    At least in my implementantation, the length(ad) field causes some
>    additional complexity, so

Could you elaborate on why knowing the length of the AD is problematic?

> 3. Do you think reduced round variants of chacha make sense? If not,
>    the name "chacha-poly1305" is nicer than "chacha20-poly1305".

I suspect that some folks will want reduced round variants since it's
faster and the reduced round versions are holding up to analysis.


Cheers

AGL