Subject: [TLS] Ciphersuite suggestion: add ISAAC

From: Ryan Carboni <[email-masked]>
Date: Mon, 22 Sep 2014 23:46:31 -0700

It's slightly more secure then RC4, but much faster.

http://burtleburtle.net/bob/rand/isaacafa.html

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 23 Sep 2014 09:27:19 -0500

It hasn’t had much review.  And for TLS 1.3 we’re only doing AEAD types of ciphers.

--
Principal Security Engineer, Akamai Technologies
IM: [email-masked]<mailto:[email-masked]> Twitter: RichSalz

---

From: Ryan Carboni <[email-masked]>
Date: Tue, 23 Sep 2014 13:26:48 -0700

https://en.wikipedia.org/wiki/ISAAC_%28cipher%29#Cryptanalysis

Such irony, people have to be famous in the crypto community in order for
their ciphers to be adopted, in order to be famous one much have ciphers
adopted.

On Tue, Sep 23, 2014 at 1:21 PM, Salz, Rich <[email-masked]> wrote:

> I looked at the webpge you posted and it seemed like there was one paper
> by someone other than the author?  And few will argue about djb’s
> credentials.
>
>
>
> More importantly, tho, is the AEAD issue.
>
>
>
> --
>
> IM: [email-masked] Twitter: RichSalz
>
>
>
> *From:* Ryan Carboni [mailto:[email-masked]]
> *Sent:* Tuesday, September 23, 2014 4:18 PM
> *To:* Salz, Rich
> *Subject:* Re: [TLS] Ciphersuite suggestion: add ISAAC
>
>
>
> Has a decade of review. Does this mean ChaCha20 won't be adopted either?
>
>
>
> On Tue, Sep 23, 2014 at 7:27 AM, Salz, Rich <[email-masked]> wrote:
>
> IM: [email-masked] Twitter: RichSalz
>
>
>

---

From: Ryan Carboni <[email-masked]>
Date: Tue, 23 Sep 2014 13:36:43 -0700

None taken. But draft proposals can always be withdrawn. And in the case of
ChaCha20-Poly1305, you don't even need to have the correct test vectors
with the first draft.

---

From: Samuel Neves <[email-masked]>
Date: Tue, 23 Sep 2014 22:57:36 +0100

> http://burtleburtle.net/bob/rand/isaacafa.html

There is no good reason to adopt ISAAC in this day and age. Let's suppose for a moment that ISAAC is perfectly secure,
and that we can bolt on some authenticator to make it AEAD. Even then it's a poor choice. Here's why:

 - Not really that fast. The core round operation of ISAAC, like RC4, uses data-dependent memory accesses and is
inherently sequential. This not only makes side-channel attacks a possibility, but also implies that the peak speed of
the cipher is limited by L1 latency. In my measurements I get no less than 3.3 cycles per byte on a Sandy Bridge CPU. In
this same CPU both Salsa20 and Chacha20 beat that, and in more recent processors beat it even more convincingly.

 - Huge internal state. ISAAC requires over 2 KB of (stack) memory just for its internal state. This can increase
overall cache misses on standard CPUs, and might make it hard to implement on the very low end.

 - There is already an RC4-like cipher among the winners of the eSTREAM competition: HC-128. I still wouldn't recommend
it, since the previous two points also apply, but it's faster than ISAAC and its initialization seems better
thought-out. At least one TLS implementation has a custom ciphersuite using HC-128:
https://github.com/cyassl/cyassl/blob/7ed180a04b5e64e9fdd355ab01eef17a60525fbd/README#L827

Best regards,
Samuel Neves

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Wed, 24 Sep 2014 03:57:07 -0400 (EDT)

----- Original Message -----
> their ciphers to be adopted, in order to be famous one much have ciphers

That's not restricted to crypto community though; fame works one way or
another, but the main drivers for such decisions are crypto competitions (e.g.,
AES, estream), and ISAAC hasn't been submitted to any.

regards,
Nikos

---

From: Alex Elsayed <[email-masked]>
Date: Tue, 23 Sep 2014 14:51:18 -0700

One can also gain credibility by breaking the ciphers of others, which 
provides a convincing argument that one understands the attacks and designed 
a cipher that doesn't fall to them easily.

And an attack is an attack no matter who found it, so no catch-22 there.

---

From: Watson Ladd <[email-masked]>
Date: Wed, 24 Sep 2014 18:44:50 -0700

> http://burtleburtle.net/bob/rand/isaacafa.html

Ok, why?

This doesn't solve the RC4 problem, which is a problem with
configurations of software that is past EOL. This cipher isn't faster
than ChaCha20, and it's less studied and trusted then AES, or probably
even Camelia. How many people are actually going to use it? What's the
usecase for it?

Sincerely,
Watson Ladd
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin

---

From: Ryan Carboni <[email-masked]>
Date: Thu, 25 Sep 2014 02:24:56 -0700

It's five instructions per byte (half a cycle on most processors). Or 18.75
instructions per 32-bit word. How can ChaCha20 possibly be faster? Or are
you confusing instructions with cycles?

How does ChaCha20 solve the RC4 problem, unless it's easier to flash
firmware to add ChaCha20?

This whole argument is illogical, ISAAC is equally as viable as ChaCha20,
and half of all crypto is a vicious cycle in which the more known something
is, the more cryptanalysis is attempted against it.

Furthermore, what if cryptographers glanced at it, and gave up? It is
easier to crack a single round of ChaCha20, whereas ISAAC has a single
round like RC4. It is inherently more difficult to break single round
ciphers because you have to break the single round, you can't break it
partially.

---

From: Alyssa Rowan <[email-masked]>
Date: Thu, 25 Sep 2014 12:43:28 +0100

Please forgive my extreme brevity; limited time.

On 25 September 2014 10:24:56 BST, Ryan Carboni <[email-masked]> wrote:
>How can ChaCha20 possibly be faster?

ChaCha20: Pipelining. Vectorisation. Parallelisation. Random-access.

ISAAC: pipeline stalls, single-threaded, dependency on big state.

>How does ChaCha20 solve the RC4 problem, unless it's easier to flash firmware to add ChaCha20?

Problem: RC4. Solution: use something better. Not convinced ISAAC is better.

>This whole argument is illogical, ISAAC is equally as viable as ChaCha20,

I disagree.

It's just a keystream generator as specified? Where's the cryptovariable=>state key setup/schedule to be used? Huge security impact. Is it the prototype one suggested?

Where's the AEAD based on it?

ISAAC didn't win any competition, nor is it a successor to anything that did.

I also think it's a bit too similar to RC4, which is a potential negative: might a successful attack against RC4 impact it?

>It is easier to crack a single round of ChaCha20, whereas ISAAC has a single round like RC4.

Apples::Oranges. ChaCha20 has 20 rounds and no attack known which weakens 7; ISAAC has only one basket, and all its eggs in it. See below.

>It is inherently more difficult to break single round ciphers because you have to break the single round, you can't break it partially.

Lack of any reduced-round variants significantly complicates cryptanalysis, as you see demonstrated above: I see this is a big negative factor, as it's harder to analyse, compare and assess the security margin.

I really don't find any aspect of it compelling or attractive. Sorry.

- --
/akr

---

From: Hubert Kario <[email-masked]>
Date: Thu, 25 Sep 2014 17:11:52 -0400 (EDT)

----- Original Message ----- 

> From: "Ryan Carboni" <[email-masked]>
> To: "Watson Ladd" <[email-masked]>
> Cc: [email-masked]
> Sent: Thursday, 25 September, 2014 11:24:56 AM
> Subject: Re: [TLS] Ciphersuite suggestion: add ISAAC

> half of all crypto is a vicious cycle in which the more known something is,
> the more cryptanalysis is attempted against it.

and how is that a bad thing?

the more a cipher is used, the better verified we want it to be

cryptographers have limited time, so it's better if they concentrate it on
most widely used algorithms not do just a cursory verification of every
cipher in existence

-- 
Regards,
Hubert Kario