Re: [TLS] ChaCha20 + Poly1305 in TLS

[Adam Langley <[e-mail]>]

On Sat, Oct 5, 2013 at 11:37 AM, Wan-Teh Chang <[e-mail]> wrote:
> * Define that <<< means a rotate left shift.

Done.

> * The second paragraph says the block counter is four input words. The
> last paragraph says the block counter is two input words.

Fixed, thanks.

>
> * The last paragraph says the nonce (input words 12 and 13) is before
> the block counter (input words 14 and 15), but
> http://cr.yp.to/chacha/chacha-20080128.pdf says the block counter is
> followed by the nonce. Assuming little-endian order, I think it seems
> better for the block counter to be before the nonce.

I got confused between Salsa and ChaCha in this case and have
corrected the draft to be in line with the ChaCha specification.

> Section 5. AEAD construction:
>
> * In the input for Poly1305, the byte count of the ciphertext is
> before the ciphertext. I think this should be reversed to allow an
> implementation to start computing Poly1305 before having all the
> ciphertext. For consistency, also reverse the order of the byte count
> of additional data and the addtional data.

Although I don't think it's needed in this case, I agree that it might
be useful and have changed the draft and code accordingly. I will
publish an updated draft shortly.

> Section 9. IANA considerations:
>
> * We should also ask IANA to assign an AEAD algorithm ID to
> chacha20poly1305 in its registry
> http://www.iana.org/assignments/aead-parameters/aead-parameters.xhtml.

Done.


Cheers

AGL