Subject: [Cfrg] Comment draft-irtf-cfrg-xchacha-01

From: Noah Schwarz <[email-masked]>
Date: Sat, 14 Sep 2019 11:39:19 +0200

Dear CFRG,

Section 2.3.1 XChaCha20 Pseudocode is incorrect regarding the block counter.

Currently:

xchacha20_encrypt(key, nonce, plaintext):
    subkey = hchacha20(key, nonce[0:15])
    chacha20_nonce = "\x00\x00\x00\x00" + nonce[16:23]
    blk_ctr = 0
    return chacha20_encrypt(subkey, chacha20_nonce, plaintext, blk_ctr)

Correction:

xchacha20_encrypt(key, nonce, plaintext, blk_ctr):
    subkey = hchacha20(key, nonce[0:15])
    chacha20_nonce = "\x00\x00\x00\x00" + nonce[16:23]
    return chacha20_encrypt(subkey, chacha20_nonce, plaintext, blk_ctr)

Kind regards,

Noah Anabiik Schwarz

---

From: Scott Arciszewski <[email-masked]>
Date: Sat, 14 Sep 2019 05:48:25 -0400

Oh, great catch. I'll be sure to fix this in draft02 (along with updating
the ChaCha20-Poly1305 RFC reference to the updated one).

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com>

On Sat, Sep 14, 2019 at 5:39 AM Noah Schwarz <[email-masked]>
wrote:

> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>