[Cfrg] Fwd: Mail regarding draft-irtf-cfrg-chacha20-poly1305

Yoav Nir <ynir.ietf@gmail.com> Fri, 17 October 2014 16:25 UTC

From: Yoav Nir <ynir.ietf@gmail.com>
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Date: Fri, 17 Oct 2014 19:25:43 +0300
References: <CE03DB3D7B45C245BCA0D2432779493605DE69@MX104CL02.corp.emc.com>
To: cfrg@irtf.org
Message-Id: <F9CF9D3B-799B-452E-8177-FB03BB611E7E@gmail.com>
Mime-Version: 1.0 (Mac OS X Mail 8.0 \(1990.1\))
Archived-At: http://mailarchive.ietf.org/arch/msg/cfrg/lCVpml8epydtnjfhuf1Vb_EzYls
Subject: [Cfrg] Fwd: Mail regarding draft-irtf-cfrg-chacha20-poly1305
Precedence: list

Message from David Black:

> This nonce reuse warning in Section 4 somewhat on the light side:
> 
>   Consequences of repeating a nonce: If a nonce is repeated, then both
>   the one-time Poly1305 key and the key-stream are identical between
>   the messages.  This reveals the XOR of the plaintexts, because the
>   XOR of the plaintexts is equal to the XOR of the ciphertexts.
> 
> Here's some blunter text that could be used as a model - this was driven
> into RFC 7146 by the secdir reviewer (it applies to all stream ciphers
> and all modes that behave like stream ciphers):
> 
>   Of particular interest are the security considerations concerning the
>   use of AES GCM [RFC4106] and AES GMAC [RFC4543]; both modes are
>   vulnerable to catastrophic forgery attacks if a nonce is ever
>   repeated with a given key.
> 
> Thanks,
> --David
> ----------------------------------------------------
> David L. Black, Distinguished Engineer
> EMC Corporation, 176 South St., Hopkinton, MA  01748
> +1 (508) 293-7953             FAX: +1 (508) 293-7786
> david.black@emc.com        Mobile: +1 (978) 394-7754
> ----------------------------------------------------

[Cfrg] Fwd: Mail regarding draft-irtf-cfrg-chacha… Yoav Nir
Re: [Cfrg] Fwd: Mail regarding draft-irtf-cfrg-ch… Ilari Liusvaara