Subject: [TLS] Poly1305 vs GCM

From: James Cloos <[email-masked]>
Date: Thu, 17 Dec 2015 14:14:18 -0500

Given the issues w/ gcm currently under discussion, and that poly1305
was originally proposed to use w/ aes, should tls recommend aes-poly1305
instead of aes-gcm for those who want to continue to use aes?

Or does chacha-poly1305 not fall victim to the 2^36 attack not because
of the aead but rather because of chacha?

-JimC
-- 
James Cloos <[email-masked]>         OpenPGP: 0x997A9F17ED7DAEA6

---

From: Ilari Liusvaara <[email-masked]>
Date: Thu, 17 Dec 2015 21:27:20 +0200

> of the aead but rather because of chacha?

AFAIK, there are two possible reasons for the difference (one or both
may contribute):

- Chacha20 is PRF(unction), AES is PRP(ermutation).
- Chacha20-Poly1305 has per-packet r and s, AES-Poly1305 and AES-GCM
  only has per-packet s and per-key r (as originally proposed).

-Ilari