Subject: [TLS] chacha/poly state?

From: "Salz, Rich" <[email-masked]>
Date: Fri, 25 Apr 2014 09:27:50 -0400

What's the current state of the Cha-Cha/Poly document?  Do things need changing, identifiers assigned, or what?

                /r$

--
Principal Security Engineer
Akamai Technologies, Cambridge, MA
IM: [email-masked]<mailto:[email-masked]>; Twitter: RichSalz

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Mon, 28 Apr 2014 09:23:17 +0200

On Fri, 2014-04-25 at 09:27 -0400, Salz, Rich wrote:
> What’s the current state of the Cha-Cha/Poly document?  Do things need
> changing, identifiers assigned, or what?

We have submitted our proposal [0] based on the new chacha construction.
It is up to the chairs to ask for WG adoption.

[0]. http://tools.ietf.org/html/draft-mavrogiannopoulos-chacha-tls-02

regards,
Nikos

---

From: Yoav Nir <[email-masked]>
Date: Mon, 28 Apr 2014 12:01:32 +0300

> [0]. http://tools.ietf.org/html/draft-mavrogiannopoulos-chacha-tls-02

The chacha in TLS draft depends on draft-nir-cfrg-chacha20-poly1305.

That still has to go through three “stages”:

 1. I need to add a bunch of test vectors and an explanation of decryption. Shouldn’t be too difficult with a counter/streamish cipher such as ChaCha

 2. We need to get a review of it. The changes to ChaCha are minor and do not affect security (IMO), but that’s just me. If we can get DJB to review it and say it’s OK - so much the better

 3. We need to find how to get this published. I submitted it as a CFRG document, but I’m not sure that’s the best way to get it published.

Yoav

---

From: Watson Ladd <[email-masked]>
Date: Mon, 28 Apr 2014 08:04:57 -0700

>  2. We need to get a review of it. The changes to ChaCha are minor and do not affect security (IMO), but that’s just me. If we can get DJB to review it and say it’s OK - so much the better

So the changes were relabeling some words as counter and others as
nonce, in a different way from ChaCha? I think if you can tell that
from a PRF, you can tell the original ChaCha from a PRF, because we
have an injection into the original input state.

Sincerely,
Watson Ladd

---

From: Adam Langley <[email-masked]>
Date: Mon, 28 Apr 2014 10:42:01 -0700

> have an injection into the original input state.

The whole AEAD construction is a "change" from the way that DJB does
it in NaCl and so probably need review. I spoke to DJB about it at
CRYPTO 2013, but that's hardly an endorsement.

Having said that, I think this does need to be pushed forward. Perhaps
the best path is as an individual submission. I'll try and add the
test vectors and then see whether that's possible.

Cheers

AGL

-- 
Adam Langley [email-masked] https://www.imperialviolet.org

---

From: Yoav Nir <[email-masked]>
Date: Mon, 28 Apr 2014 22:26:51 +0300

> test vectors and then see whether that's possible.

Yeah, so I don’t know DJB at all. Once we get the next revision published with decryption and some test vectors, we can talk to Dave and Kathleen, and see where this can progress better, and also ask DJB for a review. We didn’t get much at CFRG.

Yoav