Subject: Re: [TLS] ChaCha20 + Poly1305 in TLS

From: Wan-Teh Chang <[email-masked]>
Date: Sat, 5 Oct 2013 08:37:01 -0700

On Tue, Sep 10, 2013 at 8:22 AM, Adam Langley <[email-masked]> wrote:
> I've just posted a draft defining ChaCha20+Poly1305 cipher suites for
> TLS: https://datatracker.ietf.org/doc/draft-agl-tls-chacha20poly1305/

Hi Adam,

I just reviewed the -01 draft. I have some comments. The most
important comment is about the AEAD construction in Section 5.

Section 3. ChaCha20:

* Define that <<< means a rotate left shift.

* The second paragraph says the block counter is four input words. The
last paragraph says the block counter is two input words.

* The last paragraph says the nonce (input words 12 and 13) is before
the block counter (input words 14 and 15), but
http://cr.yp.to/chacha/chacha-20080128.pdf says the block counter is
followed by the nonce. Assuming little-endian order, I think it seems
better for the block counter to be before the nonce.

Section 5. AEAD construction:

* In the input for Poly1305, the byte count of the ciphertext is
before the ciphertext. I think this should be reversed to allow an
implementation to start computing Poly1305 before having all the
ciphertext. For consistency, also reverse the order of the byte count
of additional data and the addtional data.

Section 9. IANA considerations:

* We should also ask IANA to assign an AEAD algorithm ID to
chacha20poly1305 in its registry
http://www.iana.org/assignments/aead-parameters/aead-parameters.xhtml.

Wan-Teh Chang

---

From: Adam Langley <[email-masked]>
Date: Tue, 8 Oct 2013 11:32:35 -0400

> * Define that <<< means a rotate left shift.

Done.

> last paragraph says the block counter is two input words.

Fixed, thanks.

> better for the block counter to be before the nonce.

I got confused between Salsa and ChaCha in this case and have
corrected the draft to be in line with the ChaCha specification.

> of additional data and the addtional data.

Although I don't think it's needed in this case, I agree that it might
be useful and have changed the draft and code accordingly. I will
publish an updated draft shortly.

> http://www.iana.org/assignments/aead-parameters/aead-parameters.xhtml.

Done.

Cheers

AGL

---

From: Adam Langley <[email-masked]>
Date: Tue, 8 Oct 2013 13:03:08 -0400

> publish an updated draft shortly.

The updated draft is at
https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-02

Cheers

AGL