Subject: Re: [TLS] chacha/poly interop?

From: Jeffrey Walton <[email-masked]>
Date: Mon, 12 Sep 2016 19:35:47 -0400

On Wed, Dec 9, 2015 at 8:02 PM, Salz, Rich <[email-masked]> wrote:
> OpenSSL just landed our chacha/poly implementation into master.  We pass the
> RFC test vectors, looking for other implementations to test against.

Sorry to dig up an old thread....

I tested against Bernstein/ECRYPT ChaCha and test vectors from
http://tools.ietf.org/html/draft-strombergson-chacha-test-vectors.
TLS-ChaCha does not inter-operate with ChaCha.

The name should probably be disambiguated somehow.

Jeff

---

From: David Benjamin <[email-masked]>
Date: Tue, 13 Sep 2016 00:10:08 +0000

On Mon, Sep 12, 2016 at 7:35 PM Jeffrey Walton <[email-masked]> wrote:

> TLS-ChaCha
> <http://tools.ietf.org/html/draft-strombergson-chacha-test-vectors.TLS-ChaCha>
> does not inter-operate with ChaCha.
>

TLS-ChaCha is actually RFC 7539 which comes with its own test vectors and
isn't TLS-specific.

Our implementation matches RFC 7539 and seems to match the one test vector
I tried too. Note that that draft includes a number of things like 128-bit
keys and 8 or 12 rounds which are not applicable. The test vector whose
answer begins "0x76 0xb8 0xe0 0xad 0xa0" is the one you want.

Were you perhaps using the 128-bit key test vector? RFC 7539 doesn't use
that mode. It doesn't seem even be described in the paper, though it is in
the reference implementation. (Looks like the constants change and you put
two copies of the key in.)

David

---

From: Jeffrey Walton <[email-masked]>
Date: Mon, 12 Sep 2016 20:17:35 -0400

> TLS-ChaCha is actually RFC 7539 which comes with its own test vectors and

Oh, my bad... I grabbed the 5 vectors from
http://tools.ietf.org/html/draft-agl-tls-chacha20poly1305. I used them
because I believe the kernel-crypto is using them.

Let me try with RFC 7539 and see how things react with the 7539 vectors.

Jeff

---

From: Joachim Strömbergson <[email-masked]>
Date: Fri, 16 Sep 2016 11:13:24 +0200

Aloha!

David Benjamin wrote:
> TLS-ChaCha is actually RFC 7539 which comes with its own test
> vectors and isn't TLS-specific.
> 
> Our implementation matches RFC 7539 and seems to match the one test 
> vector I tried too. Note that that draft includes a number of things 
> like 128-bit keys and 8 or 12 rounds which are not applicable. The
> test vector whose answer begins "0x76 0xb8 0xe0 0xad 0xa0" is the one
> you want.

Also worth noting is that in RFC 7539, ChaCha has 96 bit IV/nonce and 32
bit counter instead of a 64 bit IV and 64 bit counter. The 32 extra IV
bits are used to initialize the state in the same way as 32 bits in the
counter. So its a simple matter of mapping the IV bits to the counter
bits and chacha will match the test vectors in RFC 7539. It tripped me
up when integrating the ChaCha core into my RFC 7539 ChaCha20_Poly1305 core.

https://github.com/secworks/chacha
https://github.com/secworks/ChaCha20-Poly1305

Note: the chacha-poly1305 core is not completed yet.
- -- 
Med vänlig hälsning, Yours

Joachim Strömbergson - Alltid i harmonisk svängning.
========================================================================
 Joachim Strömbergson          Secworks AB          [email-masked]
========================================================================