< draft-mavrogiannopoulos-chacha-tls-03.txt		draft-mavrogiannopoulos-chacha-tls-04.txt >
	Network Working Group A. Langley		Network Working Group A. Langley
	Internet-Draft W. Chang		Internet-Draft W. Chang
	Updates: 5246, 6347 (if approved) Google Inc		Updates: 5246, 6347 (if approved) Google Inc
	Intended status: Standards Track N. Mavrogiannopoulos		Intended status: Standards Track N. Mavrogiannopoulos
	Expires: March 26, 2015 Red Hat		Expires: June 15, 2015 Red Hat
	J. Strombergson		J. Strombergson
	Secworks Sweden AB		Secworks Sweden AB
	S. Josefsson		S. Josefsson
	SJD AB		SJD AB
	September 22, 2014		December 12, 2014
	The ChaCha Stream Cipher for Transport Layer Security		The ChaCha Stream Cipher for Transport Layer Security
	draft-mavrogiannopoulos-chacha-tls-03		draft-mavrogiannopoulos-chacha-tls-04
	Abstract		Abstract
	This document describes the use of the ChaCha stream cipher with		This document describes the use of the ChaCha stream cipher with
	HMAC-SHA1 and Poly1305 in Transport Layer Security (TLS) and Datagram		Poly1305 in Transport Layer Security (TLS) and Datagram Transport
	Transport Layer Security (DTLS) protocols.		Layer Security (DTLS) protocols.
	Status of This Memo		Status of This Memo
	This Internet-Draft is submitted in full conformance with the		This Internet-Draft is submitted in full conformance with the
	provisions of BCP 78 and BCP 79.		provisions of BCP 78 and BCP 79.
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at http://datatracker.ietf.org/drafts/current/.		Drafts is at http://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on March 26, 2015.		This Internet-Draft will expire on June 15, 2015.
	Copyright Notice		Copyright Notice
	Copyright (c) 2014 IETF Trust and the persons identified as the		Copyright (c) 2014 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(http://trustee.ietf.org/license-info) in effect on the date of		(http://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	skipping to change at page 2, line 15 ¶		skipping to change at page 2, line 15 ¶
	include Simplified BSD License text as described in Section 4.e of		include Simplified BSD License text as described in Section 4.e of
	the Trust Legal Provisions and are provided without warranty as		the Trust Legal Provisions and are provided without warranty as
	described in the Simplified BSD License.		described in the Simplified BSD License.
	Table of Contents		Table of Contents
	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2		1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
	2. The ChaCha Cipher . . . . . . . . . . . . . . . . . . . . . . 3		2. The ChaCha Cipher . . . . . . . . . . . . . . . . . . . . . . 3
	3. The Poly1305 Authenticator . . . . . . . . . . . . . . . . . 3		3. The Poly1305 Authenticator . . . . . . . . . . . . . . . . . 3
	4. ChaCha20 Cipher Suites . . . . . . . . . . . . . . . . . . . 3		4. ChaCha20 Cipher Suites . . . . . . . . . . . . . . . . . . . 3
	4.1. ChaCha20 Cipher Suites with HMAC-SHA1 . . . . . . . . . . 4		4.1. ChaCha20 Cipher Suites with Poly1305 . . . . . . . . . . 4
	4.2. ChaCha20 Cipher Suites with Poly1305 . . . . . . . . . . 4		5. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 4
	5. Updates to the TLS Standard Stream Cipher . . . . . . . . . . 5		6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 4
	6. Updates to DTLS . . . . . . . . . . . . . . . . . . . . . . . 5		7. Security Considerations . . . . . . . . . . . . . . . . . . . 5
	7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 6		8. References . . . . . . . . . . . . . . . . . . . . . . . . . 5
	8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6		8.1. Normative References . . . . . . . . . . . . . . . . . . 5
	9. Security Considerations . . . . . . . . . . . . . . . . . . . 6		8.2. Informative References . . . . . . . . . . . . . . . . . 6
	10. References . . . . . . . . . . . . . . . . . . . . . . . . . 7		Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 7
	10.1. Normative References . . . . . . . . . . . . . . . . . . 7
	10.2. Informative References . . . . . . . . . . . . . . . . . 8
	Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 9
	1. Introduction		1. Introduction
	This document describes the use of the ChaCha stream cipher in the		This document describes the use of the ChaCha stream cipher in the
	Transport Layer Security (TLS) version 1.0 [RFC2246], TLS version 1.1		Transport Layer Security (TLS) version 1.2 [RFC5246] protocol, as
	[RFC4346], and TLS version 1.2 [RFC5246] protocols, as well as in the		well as in the Datagram Transport Layer Security (DTLS) version 1.2
	Datagram Transport Layer Security (DTLS) versions 1.0 [RFC4347] and		[RFC6347], or any later versions.
	1.2 [RFC6347]. It can also be used with Secure Sockets Layer (SSL)
	version 3.0 [RFC6101].
	ChaCha [CHACHA] is a stream cipher that has been designed for high		ChaCha [CHACHA] is a stream cipher that has been designed for high
	performance in software implementations. The cipher has compact		performance in software implementations. The cipher has compact
	implementation and uses few resources and inexpensive operations that		implementation and uses few resources and inexpensive operations that
	makes it suitable for implementation on a wide range of		makes it suitable for implementation on a wide range of
	architectures. It has been designed to prevent leakage of		architectures. It has been designed to prevent leakage of
	information through side channel analysis, has a simple and fast key		information through side channel analysis, has a simple and fast key
	setup and provides good overall performance. It is a variant of		setup and provides good overall performance. It is a variant of
	Salsa20 [SALSA20SPEC] which is one of the selected ciphers in the		Salsa20 [SALSA20SPEC] which is one of the selected ciphers in the
	eSTREAM portfolio [ESTREAM].		eSTREAM portfolio [ESTREAM].
	skipping to change at page 3, line 22 ¶		skipping to change at page 3, line 17 ¶
	2. The ChaCha Cipher		2. The ChaCha Cipher
	ChaCha [CHACHA] is a stream cipher developed by D. J. Bernstein in		ChaCha [CHACHA] is a stream cipher developed by D. J. Bernstein in
	2008. It is a refinement of Salsa20 and was used as the core of the		2008. It is a refinement of Salsa20 and was used as the core of the
	SHA-3 finalist, BLAKE.		SHA-3 finalist, BLAKE.
	The variant of ChaCha used in this document is ChaCha with 20 rounds,		The variant of ChaCha used in this document is ChaCha with 20 rounds,
	a 96-bit nonce and a 256 bit key, which will be referred to as		a 96-bit nonce and a 256 bit key, which will be referred to as
	ChaCha20 in the rest of this document. This is the conservative		ChaCha20 in the rest of this document. This is the conservative
	variant (with respect to security) of the ChaCha family and is		variant (with respect to security) of the ChaCha family and is
	described in [I-D.nir-cfrg-chacha20-poly1305].		described in [I-D.irtf-cfrg-chacha20-poly1305].
	3. The Poly1305 Authenticator		3. The Poly1305 Authenticator
	Poly1305 [POLY1305] is a Wegman-Carter, one-time authenticator		Poly1305 [POLY1305] is a Wegman-Carter, one-time authenticator
	designed by D. J. Bernstein. Poly1305 takes a 32-byte, one-time		designed by D. J. Bernstein. Poly1305 takes a 32-byte, one-time
	key and a message and produces a 16-byte tag that authenticates the		key and a message and produces a 16-byte tag that authenticates the
	message such that an attacker has a negligible chance of producing a		message such that an attacker has a negligible chance of producing a
	valid tag for an inauthentic message. It is described in		valid tag for an inauthentic message. It is described in
	[I-D.nir-cfrg-chacha20-poly1305].		[I-D.irtf-cfrg-chacha20-poly1305].
	4. ChaCha20 Cipher Suites		4. ChaCha20 Cipher Suites
	In the next sections different ciphersuites are defined that utilize		In the next sections different ciphersuites are defined that utilize
	the ChaCha20 cipher combined with various message authentication		the ChaCha20 cipher combined with various message authentication
	methods.		methods.
	In all cases, the ChaCha20 cipher, as in		In all cases, the ChaCha20 cipher, as in
	[I-D.nir-cfrg-chacha20-poly1305], uses a 96-bit nonce. That nonce is		[I-D.irtf-cfrg-chacha20-poly1305], uses a 96-bit nonce. That nonce
	updated on the encryption of every TLS record, and is formed as		is updated on the encryption of every TLS record, and is formed as
	follows.		follows.
	struct {		struct {
	opaque salt[4];		opaque salt[4];
	opaque record_counter[8];		opaque record_counter[8];
	} ChaChaNonce;		} ChaChaNonce;
	The salt is generated as part of the handshake process. It is either		The salt is generated as part of the handshake process. It is either
	the client_write_IV (when the client is sending) or the		the client_write_IV (when the client is sending) or the
	server_write_IV (when the server is sending). The salt length		server_write_IV (when the server is sending). The salt length
	(SecurityParameters.fixed_iv_length) is 4 bytes. The record_counter		(SecurityParameters.fixed_iv_length) is 4 bytes. The record_counter
	is the 64-bit TLS record sequence number. In case of DTLS the		is the 64-bit TLS record sequence number. In case of DTLS the
	record_counter is formed as the concatenation of the 16-bit epoch		record_counter is formed as the concatenation of the 16-bit epoch
	with the 48-bit sequence number.		with the 48-bit sequence number.
	In both TLS and DTLS the ChaChaNonce is implicit and not sent as part		In both TLS and DTLS the ChaChaNonce is implicit and not sent as part
	of the packet.		of the packet.
	The pseudorandom function (PRF) for TLS 1.2 is the TLS PRF with		The pseudorandom function (PRF) for TLS 1.2 is the TLS PRF with
	SHA-256 as the hash function. When used with TLS versions prior to		SHA-256 as the hash function.
	1.2, the PRF is calculated as specified in the appropriate version of
	the TLS specification.
	The RSA, DHE_RSA, ECDHE_RSA, ECDHE_ECDSA, PSK, DHE_PSK, RSA_PSK,		The RSA, DHE_RSA, ECDHE_RSA, ECDHE_ECDSA, PSK, DHE_PSK, RSA_PSK,
	ECDHE_PSK key exchanges are performed as defined in [RFC5246],		ECDHE_PSK key exchanges are performed as defined in [RFC5246],
	[RFC4492], and [RFC5489].		[RFC4492], and [RFC5489].
	4.1. ChaCha20 Cipher Suites with HMAC-SHA1		4.1. ChaCha20 Cipher Suites with Poly1305
	The following CipherSuites are defined.
	TLS_RSA_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}
	TLS_ECDHE_RSA_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}
	TLS_ECDHE_ECDSA_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}
	TLS_DHE_RSA_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}
	TLS_DHE_PSK_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}
	TLS_PSK_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}
	TLS_ECDHE_PSK_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}
	TLS_RSA_PSK_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}
	The MAC algorithm used in the ciphersuites above is HMAC-SHA1
	[RFC6234].
	4.2. ChaCha20 Cipher Suites with Poly1305
	The ChaCha20 and Poly1305 primitives are built into an AEAD algorithm		The ChaCha20 and Poly1305 primitives are built into an AEAD algorithm
	[RFC5116], AEAD_CHACHA20_POLY1305, described in		[RFC5116], AEAD_CHACHA20_POLY1305, described in
	[I-D.nir-cfrg-chacha20-poly1305]. It takes as input a 256-bit key		[I-D.irtf-cfrg-chacha20-poly1305]. It takes as input a 256-bit key
	and a 96-bit nonce.		and a 96-bit nonce.
	When used in TLS, the "record_iv_length" is zero and the nonce is set		When used in TLS, the "record_iv_length" is zero and the nonce is set
	to be the ChaChaNonce. The additional data is seq_num +		to be the ChaChaNonce. The additional data is seq_num +
	TLSCompressed.type + TLSCompressed.version + TLSCompressed.length,		TLSCompressed.type + TLSCompressed.version + TLSCompressed.length,
	where "+" denotes concatenation.		where "+" denotes concatenation.
	The following CipherSuites are defined.		The following CipherSuites are defined.
	TLS_RSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_RSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	TLS_DHE_RSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_DHE_RSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	TLS_DHE_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_DHE_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	TLS_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	TLS_RSA_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_RSA_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	5. Updates to the TLS Standard Stream Cipher		5. Acknowledgements
	The ChaCha20 ciphersuites with HMAC-SHA1 defined in this document
	differ from the TLS RC4 ciphersuites that have been the basis for the
	definition of Standard Stream Cipher. Unlike RC4, ChaCha20 requires
	a nonce per record. This however, does not affect the description of
	the Standard Stream Cipher if one assumes that a nonce is optional
	and depends on the cipher's characteristics.
	Hence, this document modifies the Standard Stream Cipher by adding an
	implicit nonce. The implicit nonce may consist of
	o an optional fixed component ("salt"), generated from the
	key_block;
	o a variable component, based on the 64-bit TLS record sequence
	number or the concatenation of the 16-bit epoch with the 48-bit
	sequence number in case of DTLS.
	Stream ciphers that don't require a nonce such as RC4 shall ignore
	it. Other stream ciphers that require a nonce, such as ChaCha20 with
	HMAC-SHA1, will use the nonce and reset their state on each record.
	6. Updates to DTLS
	The DTLS protocol requires the cipher in use to introduce no
	dependencies between TLS Records to allow lost or rearranged records.
	For that it explicitly bans stream ciphers (see Section 3.1 of
	[RFC6347]).
	As the stream cipher described in this document, unlike RC4, does not
	require dependencies between records, this ban of stream ciphers is
	lifted with this document. Stream ciphers can be used with DTLS if
	they introduce no dependencies between records.
	7. Acknowledgements
	The authors would like to thank Zooko Wilcox-OHearn and Samuel Neves.		The authors would like to thank Zooko Wilcox-OHearn and Samuel Neves.
	8. IANA Considerations		6. IANA Considerations
	IANA is requested to assign the following Cipher Suites in the TLS		IANA is requested to assign the following Cipher Suites in the TLS
	Cipher Suite Registry:		Cipher Suite Registry:
	TLS_RSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_RSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	TLS_DHE_RSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_DHE_RSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	TLS_DHE_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_DHE_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	TLS_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	TLS_RSA_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}		TLS_RSA_PSK_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD}
	TLS_RSA_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}		7. Security Considerations
	TLS_ECDHE_RSA_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}
	TLS_ECDHE_ECDSA_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}
	TLS_DHE_RSA_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}
	TLS_DHE_PSK_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}
	TLS_PSK_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}
	TLS_ECDHE_PSK_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}
	TLS_RSA_PSK_WITH_CHACHA20_SHA = {0xTBD, 0xTBD}
	9. Security Considerations
	ChaCha20 follows the same basic principle as Salsa20, a cipher with		ChaCha20 follows the same basic principle as Salsa20, a cipher with
	significant security review [SALSA20-SECURITY][ESTREAM]. At the time		significant security review [SALSA20-SECURITY][ESTREAM]. At the time
	of writing this document, there are no known significant security		of writing this document, there are no known significant security
	problems with either cipher, and ChaCha20 is shown to be more		problems with either cipher, and ChaCha20 is shown to be more
	resistant in certain attacks than Salsa20 [SALSA20-ATTACK].		resistant in certain attacks than Salsa20 [SALSA20-ATTACK].
	Furthermore ChaCha20 was used as the core of the BLAKE hash function,		Furthermore ChaCha20 was used as the core of the BLAKE hash function,
	a SHA3 finalist, that had received considerable cryptanalytic		a SHA3 finalist, that had received considerable cryptanalytic
	attention [NIST-SHA3].		attention [NIST-SHA3].
	skipping to change at page 7, line 9 ¶		skipping to change at page 5, line 38 ¶
	a probability of 1-(n/2^102) for a 16*n byte message, even after		a probability of 1-(n/2^102) for a 16*n byte message, even after
	sending 2^64 legitimate messages.		sending 2^64 legitimate messages.
	The cipher suites described in this document require that a nonce is		The cipher suites described in this document require that a nonce is
	never repeated under the same key. The design presented ensures that		never repeated under the same key. The design presented ensures that
	by using the TLS sequence number which is unique and does not wrap		by using the TLS sequence number which is unique and does not wrap
	[RFC5246].		[RFC5246].
	This document should not introduce any other security considerations		This document should not introduce any other security considerations
	than those that directly follow from the use of the stream cipher		than those that directly follow from the use of the stream cipher
	ChaCha20, the AEAD_CHACHA20_POLY1305 construction, and those that		ChaCha20, the AEAD_CHACHA20_POLY1305 construction, (see also the
	directly follow from introducing any set of stream cipher suites into		Security Considerations section of
	TLS and DTLS (see also the Security Considerations section of		[I-D.irtf-cfrg-chacha20-poly1305]).
	[I-D.nir-cfrg-chacha20-poly1305]).
	10. References
	10.1. Normative References
	[RFC2246] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0",
	RFC 2246, January 1999.
	[RFC4346] Dierks, T. and E. Rescorla, "The Transport Layer Security		8. References
	(TLS) Protocol Version 1.1", RFC 4346, April 2006.
	[RFC4347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer		8.1. Normative References
	Security", RFC 4347, April 2006.
	[RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B.		[RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B.
	Moeller, "Elliptic Curve Cryptography (ECC) Cipher Suites		Moeller, "Elliptic Curve Cryptography (ECC) Cipher Suites
	for Transport Layer Security (TLS)", RFC 4492, May 2006.		for Transport Layer Security (TLS)", RFC 4492, May 2006.
	[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security		[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
	(TLS) Protocol Version 1.2", RFC 5246, August 2008.		(TLS) Protocol Version 1.2", RFC 5246, August 2008.
	[RFC5489] Badra, M. and I. Hajjeh, "ECDHE_PSK Cipher Suites for		[RFC5489] Badra, M. and I. Hajjeh, "ECDHE_PSK Cipher Suites for
	Transport Layer Security (TLS)", RFC 5489, March 2009.		Transport Layer Security (TLS)", RFC 5489, March 2009.
	[RFC6234] Eastlake, D. and T. Hansen, "US Secure Hash Algorithms
	(SHA and SHA-based HMAC and HKDF)", RFC 6234, May 2011.
	[RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer		[RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer
	Security Version 1.2", RFC 6347, January 2012.		Security Version 1.2", RFC 6347, January 2012.
	[I-D.nir-cfrg-chacha20-poly1305]		[I-D.irtf-cfrg-chacha20-poly1305]
	Nir, Y. and A. Langley, "ChaCha20 and Poly1305 for IETF		Nir, Y. and A. Langley, "ChaCha20 and Poly1305 for IETF
	protocols", draft-nir-cfrg-chacha20-poly1305-01 (work in		protocols", draft-irtf-cfrg-chacha20-poly1305-03 (work in
	progress), January 2014.		progress), November 2014.
	10.2. Informative References		8.2. Informative References
	[CHACHA] Bernstein, D., "ChaCha, a variant of Salsa20", January		[CHACHA] Bernstein, D., "ChaCha, a variant of Salsa20", January
	2008, <http://cr.yp.to/chacha/chacha-20080128.pdf>.		2008, <http://cr.yp.to/chacha/chacha-20080128.pdf>.
	[POLY1305]		[POLY1305]
	Bernstein, D., "The Poly1305-AES message-authentication		Bernstein, D., "The Poly1305-AES message-authentication
	code.", March 2005,		code.", March 2005,
	<http://cr.yp.to/mac/poly1305-20050329.pdf>.		<http://cr.yp.to/mac/poly1305-20050329.pdf>.
	[RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated		[RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated
	Encryption", RFC 5116, January 2008.		Encryption", RFC 5116, January 2008.
	[SALSA20SPEC]		[SALSA20SPEC]
	Bernstein, D., "Salsa20 specification", April 2005,		Bernstein, D., "Salsa20 specification", April 2005,
	<http://cr.yp.to/snuffle/spec.pdf>.		<http://cr.yp.to/snuffle/spec.pdf>.
	[RFC6101] Freier, A., Karlton, P., and P. Kocher, "The Secure
	Sockets Layer (SSL) Protocol Version 3.0", RFC 6101,
	August 2011.
	[SALSA20-SECURITY]		[SALSA20-SECURITY]
	Bernstein, D., "Salsa20 security", April 2005,		Bernstein, D., "Salsa20 security", April 2005,
	<http://cr.yp.to/snuffle/security.pdf>.		<http://cr.yp.to/snuffle/security.pdf>.
	[ESTREAM] Babbage, S., DeCanniere, C., Cantenaut, A., Cid, C.,		[ESTREAM] Babbage, S., DeCanniere, C., Cantenaut, A., Cid, C.,
	Gilbert, H., Johansson, T., Parker, M., Preneel, B.,		Gilbert, H., Johansson, T., Parker, M., Preneel, B.,
	Rijmen, V., and M. Robshaw, "The eSTREAM Portfolio (rev.		Rijmen, V., and M. Robshaw, "The eSTREAM Portfolio (rev.
	1)", September 2008,		1)", September 2008,
	<http://www.ecrypt.eu.org/stream/finallist.html>.		<http://www.ecrypt.eu.org/stream/finallist.html>.
End of changes. 24 change blocks.
	124 lines changed or deleted		36 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/