Re: [IPsec] Two questions about draft-ietf-ipsecme-chacha20-poly1305-00

"Scott Fluhrer (sfluhrer)" <sfluhrer@cisco.com> Mon, 30 March 2015 17:42 UTC

From: "Scott Fluhrer (sfluhrer)" <sfluhrer@cisco.com>
To: Yoav Nir <ynir.ietf@gmail.com>, "internet-drafts@ietf.org" <internet-drafts@ietf.org>
Thread-Topic: [IPsec] Two questions about draft-ietf-ipsecme-chacha20-poly1305-00
Thread-Index: AQHQavdqfbVtITbEkkWmolKMjGVLV501RvGA
Date: Mon, 30 Mar 2015 17:42:27 +0000
Message-ID: <A113ACFD9DF8B04F96395BDEACB340420D056856@xmb-rcd-x04.cisco.com>
References: <20150330133237.21486.80504.idtracker@ietfa.amsl.com> <6E938E70-324A-424E-9D20-7067BD278165@gmail.com>
In-Reply-To: <6E938E70-324A-424E-9D20-7067BD278165@gmail.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/ipsec/7QH3MpV_eUe5P6jFXRADJS1rLn0>
Cc: "ipsec@ietf.org" <ipsec@ietf.org>, "i-d-announce@ietf.org" <i-d-announce@ietf.org>
Subject: Re: [IPsec] Two questions about draft-ietf-ipsecme-chacha20-poly1305-00
Precedence: list

-----Original Message-----
From: IPsec [mailto:ipsec-bounces@ietf.org] On Behalf Of Yoav Nir
Sent: Monday, March 30, 2015 10:40 AM
To: internet-drafts@ietf.org
Cc: ipsec@ietf.org; i-d-announce@ietf.org
Subject: [IPsec] Two questions about draft-ietf-ipsecme-chacha20-poly1305-00

> Hi,
> 
> There is two questions I would like guidance from the group about.
> 
> First is the nonce/IV question: In the current draft, there is a 64-bit IV with guidance not to repeat them (so use a counter or LFSR). The function itself accepts a 96-bit input nonce, so the nonce is constructed from the 64-bit IV and 32 zero bits. The reason for doing this is so the algorithm could be used in a multi-sender case such as GDOI, where the 32-bit zero can be replaced by a sender ID. 

This idea about the multi-sender case works only if the there's a sender id somewhere in the encrypted packet.

> Alternatively, we could generate a 32-bit salt value from the key material, but I don’t see a reason why we’d want that.

Here's the reason that we do use the 32-bit salt value for GCM - to prevent batching attacks.

Consider the case that an attacker is able to collect packets from a billion (2^30) sessions; each such session contains a packet with the same IV (say, IV=0), and contains a packet with the same known plaintext (or, at least, plaintext that satisfies the same known linear equations).  Then, what an attacker can do is check a key to see if any of the IV=0 packets used that key, in constant time.  The reduces the effort for an attacker to find the n bit key for some session from 2^n to 2^{n-30}.  What the salt does is multiply the effort involved in this specific attack by a factor of 2^32 (because the attacker needs to guess the key and the salt); that way, the attacker needs to collect 4 billion sessions before this attack starts to have any advantage over a simpler attack that just attacks a single packet (which the salt doesn’t protect against).

Now, of course, chacha20 has 256 bit keys; hence even if we decided not to apply the same protection, someone with a collection of a billion sessions might be able to use this to reduce the effort to 2^226.

I'll let you decide whether this is a compelling argument or not...

[IPsec] I-D Action: draft-ietf-ipsecme-chacha20-p… internet-drafts
[IPsec] Two questions about draft-ietf-ipsecme-ch… Yoav Nir
Re: [IPsec] Two questions about draft-ietf-ipsecm… Yoav Nir
Re: [IPsec] Two questions about draft-ietf-ipsecm… Scott Fluhrer (sfluhrer)
[IPsec] Early code point assignment (was: I-D Act… Yoav Nir
[IPsec] Two questions about draft-ietf-ipsecme-ch… Tero Kivinen
Re: [IPsec] Early code point assignment (was: I-D… Yoav Nir
Re: [IPsec] Early code point assignment (was: I-D… Paul Wouters
Re: [IPsec] Early code point assignment (was: I-D… Yoav Nir
Re: [IPsec] Early code point assignment (was: I-D… Paul Wouters
Re: [IPsec] Early code point assignment (was: I-D… Tero Kivinen
Re: [IPsec] Early code point assignment (was: I-D… Paul Wouters
Re: [IPsec] Early code point assignment (was: I-D… Tero Kivinen
Re: [IPsec] Early code point assignment (was: I-D… Yoav Nir
Re: [IPsec] Early code point assignment (was: I-D… Paul Wouters
Re: [IPsec] Early code point assignment Yaron Sheffer
Re: [IPsec] Early code point assignment (was: I-D… Tero Kivinen
Re: [IPsec] Two questions about draft-ietf-ipsecm… Yoav Nir
Re: [IPsec] Two questions about draft-ietf-ipsecm… Yoav Nir
Re: [IPsec] Two questions about draft-ietf-ipsecm… Yaron Sheffer
Re: [IPsec] Two questions aboutdraft-ietf-ipsecme… Valery Smyslov
Re: [IPsec] Two questions about draft-ietf-ipsecm… Michael Richardson