idnits 2.17.1 draft-arciszewski-xchacha-03.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The abstract seems to contain references ([RFC7539]), which it shouldn't. Please replace those with straight textual mentions of the documents in question. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year == Line 176 has weird spacing: '...ccccccc ccccc...' == Line 177 has weird spacing: '...kkkkkkk kkkkk...' == Line 178 has weird spacing: '...kkkkkkk kkkkk...' == Line 179 has weird spacing: '...bbbbbbb nnnnn...' == Line 182 has weird spacing: '...ccccccc ccccc...' == (3 more instances...) == The document doesn't use any RFC 2119 keywords, yet seems to have RFC 2119 boilerplate text. -- The document date (December 18, 2018) is 1953 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- -- Looks like a reference, but probably isn't: '1' on line 361 -- Looks like a reference, but probably isn't: '2' on line 364 -- Looks like a reference, but probably isn't: '3' on line 366 -- Looks like a reference, but probably isn't: '4' on line 368 -- Looks like a reference, but probably isn't: '5' on line 370 -- Looks like a reference, but probably isn't: '6' on line 373 -- Looks like a reference, but probably isn't: '7' on line 375 -- Looks like a reference, but probably isn't: '8' on line 377 -- Looks like a reference, but probably isn't: '9' on line 379 -- Looks like a reference, but probably isn't: '10' on line 381 -- Looks like a reference, but probably isn't: '11' on line 383 -- Looks like a reference, but probably isn't: '12' on line 385 -- Looks like a reference, but probably isn't: '13' on line 387 ** Obsolete normative reference: RFC 7539 (Obsoleted by RFC 8439) Summary: 2 errors (**), 0 flaws (~~), 8 warnings (==), 14 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 (No Working Group) S. Arciszewski 3 Internet-Draft Paragon Initiative Enterprises 4 Intended status: Informational December 18, 2018 5 Expires: June 21, 2019 7 XChaCha: eXtended-nonce ChaCha and AEAD_XChaCha20_Poly1305 8 draft-arciszewski-xchacha-03 10 Abstract 12 The eXtended-nonce ChaCha cipher construction (XChaCha) allows for 13 ChaCha-based ciphersuites to accept a 192-bit nonce with similar 14 guarantees to the original construction, except with a much lower 15 probability of nonce misuse occurring. This enables XChaCha 16 constructions to be stateless, while retaining the same security 17 assumptions as ChaCha. 19 This document defines XChaCha20, which uses HChaCha20 to convert the 20 key and part of the nonce into a subkey, which is in turn used with 21 the remainder of the nonce with ChaCha20 to generate a pseudorandom 22 keystream (e.g. for message encryption). 24 This document also defines AEAD_XChaCha20_Poly1305, a variant of 25 [RFC7539] that utilizes the XChaCha20 construction in place of 26 ChaCha20. 28 Status of This Memo 30 This Internet-Draft is submitted in full conformance with the 31 provisions of BCP 78 and BCP 79. 33 Internet-Drafts are working documents of the Internet Engineering 34 Task Force (IETF). Note that other groups may also distribute 35 working documents as Internet-Drafts. The list of current Internet- 36 Drafts is at https://datatracker.ietf.org/drafts/current/. 38 Internet-Drafts are draft documents valid for a maximum of six months 39 and may be updated, replaced, or obsoleted by other documents at any 40 time. It is inappropriate to use Internet-Drafts as reference 41 material or to cite them other than as "work in progress." 43 This Internet-Draft will expire on June 21, 2019. 45 Copyright Notice 47 Copyright (c) 2018 IETF Trust and the persons identified as the 48 document authors. All rights reserved. 50 This document is subject to BCP 78 and the IETF Trust's Legal 51 Provisions Relating to IETF Documents 52 (https://trustee.ietf.org/license-info) in effect on the date of 53 publication of this document. Please review these documents 54 carefully, as they describe your rights and restrictions with respect 55 to this document. Code Components extracted from this document must 56 include Simplified BSD License text as described in Section 4.e of 57 the Trust Legal Provisions and are provided without warranty as 58 described in the Simplified BSD License. 60 Table of Contents 62 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 63 1.1. Notation and Conventions . . . . . . . . . . . . . . . . 3 64 2. AEAD_XChaCha20_Poly1305 . . . . . . . . . . . . . . . . . . . 3 65 2.1. Motivation for XChaCha20-Poly1305 . . . . . . . . . . . . 4 66 2.2. HChaCha20 . . . . . . . . . . . . . . . . . . . . . . . . 4 67 2.2.1. Test Vector for the HChaCha20 Block Function . . . . 5 68 2.3. XChaCha20 . . . . . . . . . . . . . . . . . . . . . . . . 6 69 2.3.1. XChaCha20 Pseudocode . . . . . . . . . . . . . . . . 6 70 3. Security Considerations . . . . . . . . . . . . . . . . . . . 6 71 3.1. Proving XChaCha20 to be Secure . . . . . . . . . . . . . 6 72 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 73 5. References . . . . . . . . . . . . . . . . . . . . . . . . . 8 74 5.1. Normative References . . . . . . . . . . . . . . . . . . 8 75 5.2. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 8 76 Appendix A. Additional Test Vectors . . . . . . . . . . . . . . 9 77 A.1. Example and Test Vector for AEAD_XCHACHA20_POLY1305 . . . 9 78 A.2. Example and Test Vector for XChaCha20 . . . . . . . . . . 11 79 A.3. Developer-Friendly Test Vectors . . . . . . . . . . . . . 13 80 A.3.1. AEAD_XCHACHA20_POLY1305 . . . . . . . . . . . . . . . 13 81 A.3.2. XChaCha20 . . . . . . . . . . . . . . . . . . . . . . 14 82 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 15 84 1. Introduction 86 AEAD constructions (Authenticated Encryption with Associated Data) 87 allow for message confidentiality to be assured even in the presence 88 of adaptive chosen-ciphertext attacks, but they're known to be 89 brittle to nonce-misuse conditions [1]. 91 Several nonce misuse resistant cipher constructions have been 92 proposed over the years, including AES-SIV ([RFC5297]), AES-GCM-SIV 93 [2], and several CAESAR candidates [3]. 95 However, misuse resistant cipher constructions come at a cost in 96 performance as they must necessarily make two passes over the message 97 to be encrypted. An alternative strategy can significantly reduce 98 the chance of accidental nonce reuse in environments where a large 99 number of messages are encrypted. Simply use a large enough nonce 100 such that applications can generate them randomly for each message 101 and the probability of a collision remains low. 103 To this end, we propose a solution that is already implemented in 104 many software projects that extends the nonce of ChaCha20 to 192 bits 105 and uses it to build an AEAD construction. 107 1.1. Notation and Conventions 109 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 110 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 111 document are to be interpreted as described in RFC 2119 [RFC2119]. 113 2. AEAD_XChaCha20_Poly1305 115 XChaCha20-Poly1305 is a variant of the ChaCha20-Poly1305 AEAD 116 construction as defined in [RFC7539] that uses a 192-bit nonce 117 instead of a 96-bit nonce. 119 The algorithm for XChaCha20-Poly1305 is as follows: 121 1. Calculate a subkey from the first 16 bytes of the nonce and the 122 key, using HChaCha20 (Section 2.2). 124 2. Use the subkey and remaining 8 bytes of the nonce (prefixed with 125 4 NUL bytes) with AEAD_CHACHA20_POLY1305 from [RFC7539] as 126 normal. The definition for XChaCha20 is given in Section 2.3. 128 XChaCha20-Poly1305 implementations already exist in WireGuard [4], 129 libsodium [5], Monocypher [6], xsecretbox [7], Tink [8], and in Go's 130 crypto/chacha20poly1305 [9] library. 132 Similarly, Google's HPolyC [10] implements XChaCha12. 134 Note that we're building upon uses the IETF's ChaCha20 (96-bit 135 nonce), not Bernstein's ChaCha20 (64-bit nonce). 137 2.1. Motivation for XChaCha20-Poly1305 139 The nonce used by the original ChaCha20-Poly1305 is too short to 140 safely use with random strings for long-lived keys. 141 XChaCha20-Poly1305 does not have this restriction. 143 By generating a subkey from a 128-bit nonce and the key, a reuse of 144 only the latter 64 bits of the nonce isn't security-affecting, since 145 the key (and thus, keystream) will be different. Additionally a re- 146 use of only the first 128 bits of the nonce isn't security-affecting, 147 as the nonce derived from the latter 64 bits is different. 149 Assuming a secure random number generator, random 192-bit nonces 150 should experience a single collision (with probability 50%) after 151 roughly 2^96 messages (approximately 7.2998163e+28). A more 152 conservative threshold (2^-32 chance of collision) still allows for 153 2^80 messages to be sent under a single key. 155 Therefore, with XChaCha20-Poly1305, users can safely generate a 156 random 192-bit nonce for each message and not worry about nonce-reuse 157 vulnerabilities. 159 As long as ChaCha20-Poly1305 is a secure AEAD cipher and ChaCha is a 160 secure pseudorandom function (PRF), XChaCha20-Poly1305 is secure. 162 2.2. HChaCha20 164 *HChaCha20* is an intermediary step towards XChaCha20 based on the 165 construction and security proof used to create XSalsa20 [11], an 166 extended-nonce Salsa20 variant used in NaCl [12]. 168 HChaCha20 is initialized the same way as the ChaCha cipher, except 169 that HChaCha20 uses a 128-bit nonce and has no counter. Instead, the 170 block counter is replaced by the first 32 bits of the nonce. 172 Consider the two figures below, where each non-whitespace character 173 represents one nibble of information about the ChaCha states (all 174 numbers little-endian): 176 cccccccc cccccccc cccccccc cccccccc 177 kkkkkkkk kkkkkkkk kkkkkkkk kkkkkkkk 178 kkkkkkkk kkkkkkkk kkkkkkkk kkkkkkkk 179 bbbbbbbb nnnnnnnn nnnnnnnn nnnnnnnn 181 ChaCha20 State: c=constant k=key b=blockcount n=nonce 182 cccccccc cccccccc cccccccc cccccccc 183 kkkkkkkk kkkkkkkk kkkkkkkk kkkkkkkk 184 kkkkkkkk kkkkkkkk kkkkkkkk kkkkkkkk 185 nnnnnnnn nnnnnnnn nnnnnnnn nnnnnnnn 187 HChaCha20 State: c=constant k=key n=nonce 189 After initialization, proceed through the ChaCha rounds as usual. 191 Once the 20 ChaCha rounds have been completed, the first 128 bits and 192 last 128 bits of the ChaCha state (both little-endian) are 193 concatenated, and this 256-bit subkey is returned. 195 2.2.1. Test Vector for the HChaCha20 Block Function 197 o Key = 00:01:02:03:04:05:06:07:08:09:0a:0b:0c:0d:0e:0f:10:11:12:13: 198 14:15:16:17:18:19:1a:1b:1c:1d:1e:1f. The key is a sequence of 199 octets with no particular structure before we copy it into the 200 HChaCha state. 202 o Nonce = (00:00:00:09:00:00:00:4a:00:00:00:00:31:41:59:27) 204 After setting up the HChaCha state, it looks like this: 206 61707865 3320646e 79622d32 6b206574 207 03020100 07060504 0b0a0908 0f0e0d0c 208 13121110 17161514 1b1a1918 1f1e1d1c 209 09000000 4a000000 00000000 27594131 211 ChaCha state with the key setup. 213 After running 20 rounds (10 column rounds interleaved with 10 214 "diagonal rounds"), the HChaCha state looks like this: 216 423b4182 fe7bb227 50420ed3 737d878a 217 0aa76448 7954cdf3 846acd37 7b3c58ad 218 77e35583 83e77c12 e0076a2d bc6cd0e5 219 d5e4f9a0 53a8748a 13c42ec1 dcecd326 221 HChaCha state after 20 rounds 223 HChaCha20 will then return only the first and last rows, in little 224 endian, resulting in the following 256-bit key: 226 82413b42 27b27bfe d30e4250 8a877d73 227 a0f9e4d5 8a74a853 c12ec413 26d3ecdc 229 Resultant HChaCha20 subkey 231 2.3. XChaCha20 233 XChaCha20 can be constructed from an existing ChaCha20 implementation 234 and HChaCha20. All one needs to do is: 236 1. Pass the key and the first 16 bytes of the 24-byte nonce to 237 HChaCha20 to obtain the subkey. 239 2. Use the subkey and remaining 8 byte nonce with ChaCha20 as normal 240 (prefixed by 4 NUL bytes, since [RFC7539] specifies a 12-byte 241 nonce). 243 XChaCha20 is a stream cipher and offers no integrity guarantees 244 without being combined with a MAC algorithm (e.g. Poly1305). 246 The same HChaCha20 subkey derivation can also be used in the context 247 of an AEAD_ChaCha20_Poly1305 implementation to create 248 AEAD_XChaCha20_Poly1305, as described in Section 2. 250 2.3.1. XChaCha20 Pseudocode 252 xchacha20_encrypt(key, nonce, plaintext): 253 subkey = hchacha20(key, nonce[0:15]) 254 chacha20_nonce = "\x00\x00\x00\x00" + nonce[16:23] 255 return chacha20_encrypt(subkey, 1, chacha20_nonce, plaintext) 257 3. Security Considerations 259 The security of the XChaCha construction depends on both the security 260 of the ChaCha stream cipher and the HChaCha intermediary step, for 261 reasons explained in the XSalsa20 paper [13] (which our XChaCha 262 construction is derived from). 264 Given that the 20-round ChaCha stream cipher (ChaCha20) is believed 265 to be at least as secure as Salsa20, our only relevant security 266 consideration involves HChaCha20. 268 3.1. Proving XChaCha20 to be Secure 270 In the XSalsa20 paper, when HSalsa20 is defined, the author states, 271 "The indices 0, 5, 10, 15, 6, 7, 8, 9 here were not chosen 272 arbitrarily; the choice is important for the security proof later in 273 this paper." 275 In the analysis of Theorem 3.1 from the same paper (which covers 276 generalized cascades), the author further states: "Note that this 277 bound is affected less by the insecurity of H than by the insecurity 278 of S." 279 This means that the security of HSalsa20 affects the security of 280 XSalsa20 less than Salsa20 does, and the same applies to any 281 generalized cascade following a similar construction. 283 However, we want to be sure that HChaCha is secure even if it's less 284 security-affecting than ChaCha (which we already believe to be 285 secure). 287 In Salsa20, the indices 0, 5, 10, 15 were populated with constants, 288 while the indices 6, 7, 8, and 9 were populated by the nonce. The 289 security proof for HSalsa20 relies on the definition of a function Q 290 (specified in Theorem 3.3 of the paper) that provides two critical 291 properties: 293 1. Q(i) is a public computation of H(i) and S(i). 295 2. Q(i) is a public computation of uniform random strings from 296 uniform random strings. 298 Thus, HSalsa20 uses the same indices as the public inputs (constant + 299 nonce) for its final output. 301 The reliance on public computation for the security proof makes 302 sense, and can be applied to ChaCha with a slight tweak. 304 ChaCha is a slightly different construction than Salsa20: The 305 constants occupy the indices at 0, 1, 2, 3. Meanwhile, the nonce 306 populates indices 12, 13, 14, 15. 308 Consequently, we can extract a public computation from ChaCha20 by 309 selecting these indices from HChaCha20's final state as the HChaCha20 310 output, and the same security proof can be used. 312 Therefore, if the argument that makes HSalsa20 secure is valid, then 313 it also applies to HChaCha for the corresponding output indices. 315 HSalsa20: 0, 5, 10, 15, 6, 7, 8, 9 316 HChaCha: 0, 1, 2, 3, 12, 13, 14, 15 318 Input and output indices for the relevant security proof 320 If the 20-round HChaCha (HChaCha20) is secure, and the 20-round 321 ChaCha20 is secure, then XChaCha20 is also secure. 323 4. IANA Considerations 325 This document defines a new stream cipher ("XChaCha20", see 326 Section 2.3) and a new AEAD cipher construction 327 ("XChaCha20-Poly1305", see Section 2). 329 A new entry in the "Authenticated Encryption with Associated Data 330 (AEAD) Parameters" registry with the name "AEAD_XCHACHA20_POLY1305" 331 should be assigned. 333 Name | Reference | Number Identifier 334 ------------------------+-----------+------------------ 335 AEAD_XCHACHA20_POLY1305 | Section 2 | TBD1 337 5. References 339 5.1. Normative References 341 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 342 Requirement Levels", BCP 14, RFC 2119, 343 DOI 10.17487/RFC2119, March 1997, 344 . 346 [RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data 347 Encodings", RFC 4648, DOI 10.17487/RFC4648, October 2006, 348 . 350 [RFC5297] Harkins, D., "Synthetic Initialization Vector (SIV) 351 Authenticated Encryption Using the Advanced Encryption 352 Standard (AES)", RFC 5297, DOI 10.17487/RFC5297, October 353 2008, . 355 [RFC7539] Nir, Y. and A. Langley, "ChaCha20 and Poly1305 for IETF 356 Protocols", RFC 7539, DOI 10.17487/RFC7539, May 2015, 357 . 359 5.2. URIs 361 [1] https://cryptologie.net/article/361/breaking-https-aes-gcm-or-a- 362 part-of-it/ 364 [2] https://eprint.iacr.org/2017/168.pdf 366 [3] https://competitions.cr.yp.to/caesar-submissions.html 368 [4] https://www.wireguard.com 370 [5] https://download.libsodium.org/doc/secret-key_cryptography/ 371 xchacha20-poly1305_construction.html 373 [6] https://monocypher.org/manual/aead 375 [7] https://github.com/jedisct1/xsecretbox 377 [8] https://github.com/google/tink 379 [9] https://godoc.org/golang.org/x/crypto/chacha20poly1305#NewX 381 [10] https://github.com/google/hpolyc 383 [11] https://cr.yp.to/snuffle/xsalsa-20110204.pdf 385 [12] https://nacl.cr.yp.to 387 [13] https://cr.yp.to/snuffle/xsalsa-20110204.pdf 389 Appendix A. Additional Test Vectors 391 A.1. Example and Test Vector for AEAD_XCHACHA20_POLY1305 393 Plaintext: 395 000 4c 61 64 69 65 73 20 61 6e 64 20 47 65 6e 74 6c Ladies and Gentl 396 016 65 6d 65 6e 20 6f 66 20 74 68 65 20 63 6c 61 73 emen of the clas 397 032 73 20 6f 66 20 27 39 39 3a 20 49 66 20 49 20 63 s of '99: If I c 398 048 6f 75 6c 64 20 6f 66 66 65 72 20 79 6f 75 20 6f ould offer you o 399 064 6e 6c 79 20 6f 6e 65 20 74 69 70 20 66 6f 72 20 nly one tip for 400 080 74 68 65 20 66 75 74 75 72 65 2c 20 73 75 6e 73 the future, suns 401 096 63 72 65 65 6e 20 77 6f 75 6c 64 20 62 65 20 69 creen would be i 402 112 74 2e t. 404 AAD: 406 000 50 51 52 53 c0 c1 c2 c3 c4 c5 c6 c7 PQRS........ 408 Key: 410 000 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f ................ 411 016 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f ................ 413 IV: 415 000 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f @ABCDEFGHIJKLMNO 416 016 50 51 52 53 54 55 56 57 PQRSTUVW 417 32-bit fixed-common part: 419 000 00 00 00 00 .... 421 Poly1305 Key: 423 000 7b 19 1f 80 f3 61 f0 99 09 4f 6f 4b 8f b9 7d f8 {....a...OoK..}. 424 016 47 cc 68 73 a8 f2 b1 90 dd 73 80 71 83 f9 07 d5 G.hs.....s.q.... 426 Ciphertext: 428 000 bd 6d 17 9d 3e 83 d4 3b 95 76 57 94 93 c0 e9 39 .m..>..;.vW....9 429 016 57 2a 17 00 25 2b fa cc be d2 90 2c 21 39 6c bb W*..%+.....,!9l. 430 032 73 1c 7f 1b 0b 4a a6 44 0b f3 a8 2f 4e da 7e 39 s....J.D.../N.~9 431 048 ae 64 c6 70 8c 54 c2 16 cb 96 b7 2e 12 13 b4 52 .d.p.T.........R 432 064 2f 8c 9b a4 0d b5 d9 45 b1 1b 69 b9 82 c1 bb 9e /......E..i..... 433 080 3f 3f ac 2b c3 69 48 8f 76 b2 38 35 65 d3 ff f9 ??.+.iH.v.85e... 434 096 21 f9 66 4c 97 63 7d a9 76 88 12 f6 15 c6 8b 13 !.fL.c}.v....... 435 112 b5 2e .. 437 Tag: 439 c0:87:59:24:c1:c7:98:79:47:de:af:d8:78:0a:cf:49 441 A.2. Example and Test Vector for XChaCha20 443 Note: This is for the XChaCha20 stream cipher itself, not the AEAD 444 construction. 446 Counter: 1 448 Plaintext: 450 000 54 68 65 20 64 68 6f 6c 65 20 28 70 72 6f 6e 6f The dhole (prono 451 010 75 6e 63 65 64 20 22 64 6f 6c 65 22 29 20 69 73 unced "dole") is 452 020 20 61 6c 73 6f 20 6b 6e 6f 77 6e 20 61 73 20 74 also known as t 453 030 68 65 20 41 73 69 61 74 69 63 20 77 69 6c 64 20 he Asiatic wild 454 040 64 6f 67 2c 20 72 65 64 20 64 6f 67 2c 20 61 6e dog, red dog, an 455 050 64 20 77 68 69 73 74 6c 69 6e 67 20 64 6f 67 2e d whistling dog. 456 060 20 49 74 20 69 73 20 61 62 6f 75 74 20 74 68 65 It is about the 457 070 20 73 69 7a 65 20 6f 66 20 61 20 47 65 72 6d 61 size of a Germa 458 080 6e 20 73 68 65 70 68 65 72 64 20 62 75 74 20 6c n shepherd but l 459 090 6f 6f 6b 73 20 6d 6f 72 65 20 6c 69 6b 65 20 61 ooks more like a 460 0a0 20 6c 6f 6e 67 2d 6c 65 67 67 65 64 20 66 6f 78 long-legged fox 461 0b0 2e 20 54 68 69 73 20 68 69 67 68 6c 79 20 65 6c . This highly el 462 0c0 75 73 69 76 65 20 61 6e 64 20 73 6b 69 6c 6c 65 usive and skille 463 0d0 64 20 6a 75 6d 70 65 72 20 69 73 20 63 6c 61 73 d jumper is clas 464 0e0 73 69 66 69 65 64 20 77 69 74 68 20 77 6f 6c 76 sified with wolv 465 0f0 65 73 2c 20 63 6f 79 6f 74 65 73 2c 20 6a 61 63 es, coyotes, jac 466 100 6b 61 6c 73 2c 20 61 6e 64 20 66 6f 78 65 73 20 kals, and foxes 467 110 69 6e 20 74 68 65 20 74 61 78 6f 6e 6f 6d 69 63 in the taxonomic 468 120 20 66 61 6d 69 6c 79 20 43 61 6e 69 64 61 65 2e family Canidae. 470 Key: 472 000 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f ................ 473 016 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f ................ 475 IV: 477 000 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f @ABCDEFGHIJKLMNO 478 016 50 51 52 53 54 55 56 58 PQRSTUVX 479 Keystream: 481 000: 29 62 4b 4b 1b 14 0a ce 53 74 0e 40 5b 21 68 54 )bKK....St.@[!hT 482 010: 0f d7 d6 30 c1 f5 36 fe cd 72 2f c3 cd db a7 f4 ...0..6..r/..... 483 020: cc a9 8c f9 e4 7e 5e 64 d1 15 45 0f 9b 12 5b 54 .....~^d..E...[T 484 030: 44 9f f7 61 41 ca 62 0a 1f 9c fc ab 2a 1a 8a 25 D..aA.b.....*..% 485 040: 5e 76 6a 52 66 b8 78 84 61 20 ea 64 ad 99 aa 47 ^vjRf.x.a .d...G 486 050: 94 71 e6 3b ef cb d3 7c d1 c2 2a 22 1f e4 62 21 .q.;...|..*"..b! 487 060: 5c f3 2c 74 89 5b f5 05 86 3c cd dd 48 f6 29 16 \.,t.[...<..H.). 488 070: dc 65 21 f1 ec 50 a5 ae 08 90 3a a2 59 d9 bf 60 .e!..P....:.Y..` 489 080: 7c d8 02 6f ba 54 86 04 f1 b6 07 2d 91 bc 91 24 |..o.T.....-...$ 490 090: 3a 5b 84 5f 7f d1 71 b0 2e dc 5a 0a 84 cf 28 dd :[._..q...Z...(. 491 0a0: 24 11 46 bc 37 6e 3f 48 df 5e 7f ee 1d 11 04 8c $.F.7n?H.^...... 492 0b0: 19 0a 3d 3d eb 0f eb 64 b4 2d 9c 6f de ee 29 0f ..==...d.-.o..). 493 0c0: a0 e6 ae 2c 26 c0 24 9e a8 c1 81 f7 e2 ff d1 00 ...,&.$......... 494 0d0: cb e5 fd 3c 4f 82 71 d6 2b 15 33 0c b8 fd cf 00 ...