Re: [TLS] ChaCha20 + Poly1305 in TLS

[Wan-Teh Chang <[e-mail]>]

On Tue, Sep 10, 2013 at 8:22 AM, Adam Langley <[e-mail]> wrote:
> I've just posted a draft defining ChaCha20+Poly1305 cipher suites for
> TLS: https://datatracker.ietf.org/doc/draft-agl-tls-chacha20poly1305/

Hi Adam,

I just reviewed the -01 draft. I have some comments. The most
important comment is about the AEAD construction in Section 5.

Section 3. ChaCha20:

* Define that <<< means a rotate left shift.

* The second paragraph says the block counter is four input words. The
last paragraph says the block counter is two input words.

* The last paragraph says the nonce (input words 12 and 13) is before
the block counter (input words 14 and 15), but
http://cr.yp.to/chacha/chacha-20080128.pdf says the block counter is
followed by the nonce. Assuming little-endian order, I think it seems
better for the block counter to be before the nonce.

Section 5. AEAD construction:

* In the input for Poly1305, the byte count of the ciphertext is
before the ciphertext. I think this should be reversed to allow an
implementation to start computing Poly1305 before having all the
ciphertext. For consistency, also reverse the order of the byte count
of additional data and the addtional data.

Section 9. IANA considerations:

* We should also ask IANA to assign an AEAD algorithm ID to
chacha20poly1305 in its registry
http://www.iana.org/assignments/aead-parameters/aead-parameters.xhtml.

Wan-Teh Chang