Subject: [Cfrg] I-D Action: draft-irtf-cfrg-chacha20-poly1305-06.txt

From: [email-masked]
Date: Wed, 14 Jan 2015 06:34:13 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Crypto Forum Working Group of the IETF.

        Title           : ChaCha20 and Poly1305 for IETF protocols
        Authors         : Yoav Nir
                          Adam Langley
	Filename        : draft-irtf-cfrg-chacha20-poly1305-06.txt
	Pages           : 43
	Date            : 2015-01-14

Abstract:
   This document defines the ChaCha20 stream cipher, as well as the use
   of the Poly1305 authenticator, both as stand-alone algorithms, and as
   a "combined mode", or Authenticated Encryption with Additional Data
   (AEAD) algorithm.

   This document does not introduce any new crypto, but is meant to
   serve as a stable reference and an implementation guide.  It is a
   product of the Crypto Forum Research Group (CFRG)

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-irtf-cfrg-chacha20-poly1305/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-irtf-cfrg-chacha20-poly1305-06

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-chacha20-poly1305-06

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Alyssa Rowan <[email-masked]>
Date: Wed, 14 Jan 2015 14:50:37 +0000

Quick nit:

> The calculated tag is bitwise compared to the received tag.

..."in constant time", perhaps we should add there, in case someone gets some bright ideas with plain vanilla memcmp() from that paragraph?

Just a thought.

- --
/akr

---

From: Yoav Nir <[email-masked]>
Date: Wed, 14 Jan 2015 17:09:10 +0200

Does it matter?  

memcmp works word-by-word, so on a 32-bit system the attacker would need to send 4 * 2^32 / 2 copies of a message with different tags to guess the correct tag without valid traffic invalidating the AAD. And that assumes that memcmp on 16 bytes can even be measured when it stops prematurely.

OK, I’ll add a line to the security considerations.

Yoav

> On Jan 14, 2015, at 4:50 PM, Alyssa Rowan <[email-masked]> wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
> 
> -----BEGIN PGP SIGNATURE-----
> Version: APG v1.1.1
> 
> iQI3BAEBCgAhBQJUtoI9GhxBbHlzc2EgUm93YW4gPGFrckBha3IuaW8+AAoJEOyE
> jtkWi2t61tkP/0quTyB88CG1IF5l5xDDDTuzKqIIGn9rMgX4glRCj2x38q4cDfUY
> 1mB7nPjd+c4zFZj2XqeT3ZBVeLmkOAua8MnJhVlfHvmHnyaYWOf5iYBAk1mEXcV5
> fMN1dnJdqs3mLFgqSq8SaEHcF6r5GgS6z/gb0Cvu4+iO6JkM1BPabDtBQtu7Zh64
> bzlqpMqOqpLkflpBkjBiLNR6jU4WXSmvLYiPqhCL8qdwaioFMV0s3PYRq+9AMbvI
> /yIhGLGnbH7nYMvE4lu5kIVb6XN4+/wDZ3+3MiwyKzfWhVoBK3v0bOGMSUjoDVNt
> zuP/BLcU5tvJvKPZl2Ok0XDh5+ZUMZNTNzi1tHfRjnItjtPkRoB6QVyE23if8aBe
> +59JRUSAnIs4/jdnvig85BLhnnXQ9A8ac/SShfEoVNCfPhxGp5espwS+5Nbsv8VV
> VCa8CP2zw1mPc3qphoEb8y+loCgq3wAVAZAnBpWs8nIzzPKYr/4DKArQT6BTUqhQ
> fqx5Rc99HgXB7GMA9HULrAoaDkB9AttCZkbS16FDJ9kbeacHLINfMnJY2vhzS1CM
> 1T3UJ3bdahnIpH5mAvB2fG7wtK2CISJ7qIMATgsgQFvl4dr+8JRrpecma+PvV/ms
> yclTFAbnV9Pjk7IALd7aLHjtxW7wxSNVYlx5/fmY9zWFc1HiuIorJS7e
> =h6PU
> -----END PGP SIGNATURE-----
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg

---

From: Yoav Nir <[email-masked]>
Date: Wed, 14 Jan 2015 18:06:33 +0200

OK. Submitted

On Wed, Jan 14, 2015 at 5:09 PM, Yoav Nir <[email-masked]> wrote:

> Does it matter?
>
> memcmp works word-by-word, so on a 32-bit system the attacker would need
> to send 4 * 2^32 / 2 copies of a message with different tags to guess the
> correct tag without valid traffic invalidating the AAD. And that assumes
> that memcmp on 16 bytes can even be measured when it stops prematurely.
>
> > ..."in constant time", perhaps we should add there, in case someone gets
> some bright ideas with plain vanilla memcmp() from that paragraph?
> >
> > Just a thought.
> >
> > - --
> > /akr

---

From: Alyssa Rowan <[email-masked]>
Date: Thu, 15 Jan 2015 08:09:44 +0000

On 14/01/2015 16:06, Yoav Nir wrote:

>> ..."in constant time", perhaps we should add there, in case 
>> someone gets some bright ideas with plain vanilla memcmp() from 
>> that paragraph? Just a thought.
> Does it matter?

Possibly not, as you say; but caution definitely can't hurt here.

> OK. Submitted

Thanks very much.

- -- 
/akr

---

From: Yoav Nir <[email-masked]>
Date: Thu, 15 Jan 2015 12:49:42 +0200

> On Jan 15, 2015, at 10:09 AM, Alyssa Rowan <[email-masked]> wrote:
> 

I’m guessing anyone who is implementing a security algorithm or security protocol already has a constant-time variation of memcmp (and if they don’t, they really really should). So a reminder to use this API instead of that API is not such an onerous requirement.