Subject: [Cfrg] FW: Request for review of ChaCha/Poly1305

From: "Paterson, Kenny" <[email-masked]>
Date: Fri, 25 Jul 2014 16:04:52 +0000

Dear CFRG,

We have been formally requested by the TLS WG to provide review on this
document:

https://datatracker.ietf.org/doc/draft-irtf-cfrg-chacha20-poly1305/

defining an AEAD construction using the ChaCha and Poly1305 algorithms.
This scheme is being considered by the TLS WG for adoption in TLS.

There are two aspects to the request:

A) analysis of the individual algorithms;
B) analysis of the composition (in Section 2.8 of the document).

My sense is that novel analysis of the algorithms (A) is not likely to be
forthcoming from this group within a realistic timeframe. We can instead
hope that the adoption of ChaCha in TLS will spur further analysis of it
by the research community in the longer term.

On the other hand, analysis of the composition (B) should be within our
collective reach within a realistic timeframe.

Comments, please.

Best wishes

Kenny (for the chairs)

On 24/07/2014 15:47, "Sean Turner" <[email-masked]> wrote:

>The TLS WG is currently considering the use of ChaCha/Poly1305
>cipher suites in TLS. Can you please provide the CFRG's feedback
>on the suitability of these algorithms and of the AEAD construction
>found in the following draft:
>
>https://datatracker.ietf.org/doc/draft-irtf-cfrg-chacha20-poly1305/
>
>Thanks,
>S&J

---

From: Gordon Procter <[email-masked]>
Date: Tue, 29 Jul 2014 11:05:33 +0100

>collective reach within a realistic timeframe.

Hi Kenny,

I can spend some time looking at this (specifically the composition).

Gordon