Re: [TLS] Comments on draft-nir-cfrg-chacha20-poly1305-02

[Adam Langley <[e-mail]>]

On Fri, Feb 6, 2015 at 6:10 AM, Niels Möller <[e-mail]> wrote:
> Adam Langley <[e-mail]> writes:
>
>> On Thu, May 8, 2014 at 12:32 AM, Niels Möller <[e-mail]> wrote:
>>> Is this something you'd want to address? After all, high performance is
>>> one of the primary design goals for both chacha and poly1305. The easiest
>>> way I see is to change the formatting for authentication to
>>>
>>>   ad | pad1 | cryptotext | pad2 | length(ad) | length(cryptotext)
>>
>> I think this might be a good idea, thanks!
>
> I've now updated my implementation to match
> draft-irtf-cfrg-chacha20-poly1305-08
> (https://git.lysator.liu.se/nettle/nettle/blob/master/chacha-poly1305.c).
> I have a couple of comments on the testcases.

+Yoav, so that he sees this, as he's doing the editing work on this
draft in practice.

> In section 2.4.2, the test vector for the chacha20 cipher, I think it
> would be good to have an example with initial counter = 0. I think
> that's going to be the typical case when using chacha as cipher only.

The draft defines an AEAD so I think it's ok that the examples are
focused on that.

> In section 2.8.2, the nonce is given in two pieces, an "IV" and a
> "32-bit fixed common part". It's not crystal clear how to put then
> together. Please also write out the complete 12-byte nonce explicitly.

It does seem that this section might be a little IPSec focused. The
nonce is called an nonce elsewhere in the draft, but is given as an
"IV" and "fixed-common part" here, but those terms are never used
elsewhere. Possibly they should be merged and called an nonce,
although I'm sure that Yoav will decide what's best here.

> For naming, I think it would be more consistent with the (admittedly
> confused) terminology used in the literature to consistently write
> "chacha", not "chacha20", and "salsa20", not "salsa".

ChaCha is the family and ChaCha20 is an instance with a specific
number of rounds. I think the two names are ok, although I do think
there's a little confusion at the beginning of section 2.3 where it
might be worth mentioning that the the ChaCha20 block function is
specifically the ChaCha block function with 20 rounds.


Cheers

AGL