Subject: [Cfrg] AEAD outputs and RFC 7539 (ChaCha20-Poly1305)

From: Martin Thomson <[email-masked]>
Date: Mon, 23 May 2016 17:45:14 -0400

https://tools.ietf.org/html/rfc7539#section-2.8 says:

   The output from the AEAD is twofold:

   o  A ciphertext of the same length as the plaintext.
   o  A 128-bit tag, which is the output of the Poly1305 function.

However, https://tools.ietf.org/html/rfc5116#section-2.1, which
defines the interface says this:

   There is a single output:

      A ciphertext C, which is at least as long as the plaintext, or

      an indication that the requested encryption operation could not be
      performed.

And later makes it clear that C includes the authentication tag by noting that:

   An AEAD_AES_128_GCM ciphertext is exactly 16 octets longer than its
   corresponding plaintext.

This suggests to me that there is an erratum to be raised.  amirite?

---

From: Adam Langley <[email-masked]>
Date: Mon, 23 May 2016 16:36:42 -0700

> This suggests to me that there is an erratum to be raised.  amirite?

I favour the model of RFC5116, but it's not universal. There are
certainly cases where the separate parts are used, for example when
encrypting in place and storing tags out of band.

Cheers

AGL

-- 
Adam Langley [email-masked] https://www.imperialviolet.org

---

From: Martin Thomson <[email-masked]>
Date: Mon, 23 May 2016 19:57:10 -0400

> encrypting in place and storing tags out of band.

I'm sure those people with special needs can use special tools.  The
only reason I point this out is that it makes it harder to point at
ChaCha... as an AEAD.

---

From: Yoav Nir <[email-masked]>
Date: Tue, 24 May 2016 09:02:19 +0300

> On 24 May 2016, at 2:57 AM, Martin Thomson <[email-masked]> wrote:
> 

Seems right. Perhaps the report should say:

OLD:

New:
  The output from the AEAD is a concatenation of two parts:

Yoav

---

From: Russ Housley <[email-masked]>
Date: Wed, 25 May 2016 18:17:51 -0400

>  The output from the AEAD is a concatenation of two parts:

That makes sense to me.

Russ