Subject: [Cfrg] And we are the experts?

From: Watson Ladd <[email-masked]>
Date: Wed, 9 Apr 2014 23:30:53 -0700

On Wed, Apr 9, 2014 at 9:17 PM, Yoav Nir <[email-masked]> wrote:
>
> On Apr 10, 2014, at 4:45 AM, Watson Ladd <[email-masked]> wrote:
>
> On Wed, Apr 9, 2014 at 11:38 AM, S Moonesamy <[email-masked]> wrote:
>
> At 11:10 09-04-2014, David McGrew wrote:
>
>
> I particularly like "Joe Salowey: TLS should not be using stream
> cipher." in a discussion of ChaCha20+Poly1305. Was this a matter of
> not understanding what ChaCha20+Poly1305 is, a deep technical point
> about how TLS works (and how somehow it worked with RC4), or something
> else entirely?
>
>
> There was a feeling in the room that ChaCha20 was not really a stream cipher
> like RC4, but more like a block cipher in counter mode (with a 512-bit block
> size).
> In particular, there’s no long-lived state between invocation that is likely
> to lead to bias in the key stream, such as there is in RC4

This is not the way to make a decision about cryptographic strength.
Trivium is strong despite looking a lot closer to RC4 then a block
cipher. FEAL in counter mode would have all the security of FEAL: it
would be worse than RC4 (2^12 known plaintexts to complete break). The
ChaCha function is a weak hash: it is the diagonal constants that stop
a lot of bad things. (In particular, ChaCha of the all zero state
outputs all zeros) But ChaCha is a very strong stream cipher: 6-rounds
with 2^{107} time is the best known result from 2013.

The logic in that statement would also rule out using duplex mode
constructions with sponges.

The average CFRG member is not an expert on any matter that passes
through. And so what you do is you find out what the experts think.
You sit down with the past however many years of Springer conference
proceedings from Latincrypt, Asiacrypt, FSE, and Crypto, as well as
IACR eprints. Even if there is nothing like a break, there should be
results on nonexistence of differentials, etc. What you don't do is
base your decision on your knowledge of things you don't understand.

Why wasn't ChaCha20+Poly1305 entered in to CAESER? It would have been
a free way to get it reviewed seriously. Anyway, if ChaCha20 is a PRF
the construction is a secure AEAD scheme. I can work out a more
precise statement if desired.

Sincerely,
Watson Ladd
> HTH
> Yoav

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin