idnits 2.17.1 draft-irtf-cfrg-xchacha-01.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The abstract seems to contain references ([RFC7539]), which it shouldn't. Please replace those with straight textual mentions of the documents in question. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year == Line 180 has weird spacing: '...ccccccc ccccc...' == Line 181 has weird spacing: '...kkkkkkk kkkkk...' == Line 182 has weird spacing: '...kkkkkkk kkkkk...' == Line 183 has weird spacing: '...bbbbbbb nnnnn...' == Line 186 has weird spacing: '...ccccccc ccccc...' == (4 more instances...) == The document doesn't use any RFC 2119 keywords, yet seems to have RFC 2119 boilerplate text. -- The document date (July 23, 2019) is 1739 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- -- Looks like a reference, but probably isn't: '1' on line 368 -- Looks like a reference, but probably isn't: '2' on line 371 -- Looks like a reference, but probably isn't: '3' on line 373 -- Looks like a reference, but probably isn't: '4' on line 375 -- Looks like a reference, but probably isn't: '5' on line 377 -- Looks like a reference, but probably isn't: '6' on line 380 -- Looks like a reference, but probably isn't: '7' on line 382 -- Looks like a reference, but probably isn't: '8' on line 384 -- Looks like a reference, but probably isn't: '9' on line 386 -- Looks like a reference, but probably isn't: '10' on line 388 -- Looks like a reference, but probably isn't: '11' on line 392 -- Looks like a reference, but probably isn't: '12' on line 394 -- Looks like a reference, but probably isn't: '13' on line 396 ** Obsolete normative reference: RFC 7539 (Obsoleted by RFC 8439) Summary: 2 errors (**), 0 flaws (~~), 8 warnings (==), 14 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 (No Working Group) S. Arciszewski 3 Internet-Draft Paragon Initiative Enterprises 4 Intended status: Informational July 23, 2019 5 Expires: January 24, 2020 7 XChaCha: eXtended-nonce ChaCha and AEAD_XChaCha20_Poly1305 8 draft-irtf-cfrg-xchacha-01 10 Abstract 12 The eXtended-nonce ChaCha cipher construction (XChaCha) allows for 13 ChaCha-based ciphersuites to accept a 192-bit nonce with similar 14 guarantees to the original construction, except with a much lower 15 probability of nonce misuse occurring. This helps for long running 16 TLS connections. This also enables XChaCha constructions to be 17 stateless, while retaining the same security assumptions as ChaCha. 19 This document defines XChaCha20, which uses HChaCha20 to convert the 20 key and part of the nonce into a subkey, which is in turn used with 21 the remainder of the nonce with ChaCha20 to generate a pseudorandom 22 keystream (e.g. for message encryption). 24 This document also defines AEAD_XChaCha20_Poly1305, a variant of 25 [RFC7539] that utilizes the XChaCha20 construction in place of 26 ChaCha20. 28 Status of This Memo 30 This Internet-Draft is submitted in full conformance with the 31 provisions of BCP 78 and BCP 79. 33 Internet-Drafts are working documents of the Internet Engineering 34 Task Force (IETF). Note that other groups may also distribute 35 working documents as Internet-Drafts. The list of current Internet- 36 Drafts is at https://datatracker.ietf.org/drafts/current/. 38 Internet-Drafts are draft documents valid for a maximum of six months 39 and may be updated, replaced, or obsoleted by other documents at any 40 time. It is inappropriate to use Internet-Drafts as reference 41 material or to cite them other than as "work in progress." 43 This Internet-Draft will expire on January 24, 2020. 45 Copyright Notice 47 Copyright (c) 2019 IETF Trust and the persons identified as the 48 document authors. All rights reserved. 50 This document is subject to BCP 78 and the IETF Trust's Legal 51 Provisions Relating to IETF Documents 52 (https://trustee.ietf.org/license-info) in effect on the date of 53 publication of this document. Please review these documents 54 carefully, as they describe your rights and restrictions with respect 55 to this document. Code Components extracted from this document must 56 include Simplified BSD License text as described in Section 4.e of 57 the Trust Legal Provisions and are provided without warranty as 58 described in the Simplified BSD License. 60 Table of Contents 62 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 63 1.1. Notation and Conventions . . . . . . . . . . . . . . . . 3 64 2. AEAD_XChaCha20_Poly1305 . . . . . . . . . . . . . . . . . . . 3 65 2.1. Motivation for XChaCha20-Poly1305 . . . . . . . . . . . . 4 66 2.2. HChaCha20 . . . . . . . . . . . . . . . . . . . . . . . . 4 67 2.2.1. Test Vector for the HChaCha20 Block Function . . . . 5 68 2.3. XChaCha20 . . . . . . . . . . . . . . . . . . . . . . . . 6 69 2.3.1. XChaCha20 Pseudocode . . . . . . . . . . . . . . . . 6 70 3. Security Considerations . . . . . . . . . . . . . . . . . . . 6 71 3.1. Proving XChaCha20 to be Secure . . . . . . . . . . . . . 6 72 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 73 5. References . . . . . . . . . . . . . . . . . . . . . . . . . 8 74 5.1. Normative References . . . . . . . . . . . . . . . . . . 8 75 5.2. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 8 76 Appendix A. Additional Test Vectors . . . . . . . . . . . . . . 9 77 A.1. Example and Test Vector for AEAD_XCHACHA20_POLY1305 . . . 9 78 A.2. Example and Test Vectors for XChaCha20 . . . . . . . . . 11 79 A.2.1. With Block Counter = 0 . . . . . . . . . . . . . . . 11 80 A.2.2. With Block Counter = 1 . . . . . . . . . . . . . . . 13 81 A.3. Developer-Friendly Test Vectors . . . . . . . . . . . . . 15 82 A.3.1. AEAD_XCHACHA20_POLY1305 . . . . . . . . . . . . . . . 15 83 A.3.2. XChaCha20 . . . . . . . . . . . . . . . . . . . . . . 16 84 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 18 86 1. Introduction 88 AEAD constructions (Authenticated Encryption with Associated Data) 89 allow for message confidentiality to be assured even in the presence 90 of adaptive chosen-ciphertext attacks, but they're known to be 91 brittle to nonce-misuse conditions [1]. 93 Several nonce misuse resistant cipher constructions have been 94 proposed over the years, including AES-SIV ([RFC5297]), AES-GCM-SIV 95 [2], and several CAESAR candidates [3]. 97 However, misuse resistant cipher constructions come at a cost in 98 performance as they must necessarily make two passes over the message 99 to be encrypted. An alternative strategy can significantly reduce 100 the chance of accidental nonce reuse in environments where a large 101 number of messages are encrypted. Simply use a large enough nonce 102 such that applications can generate them randomly for each message 103 and the probability of a collision remains low. 105 To this end, we propose a solution that is already implemented in 106 many software projects that extends the nonce of ChaCha20 to 192 bits 107 and uses it to build an AEAD construction. 109 1.1. Notation and Conventions 111 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 112 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 113 document are to be interpreted as described in RFC 2119 [RFC2119]. 115 2. AEAD_XChaCha20_Poly1305 117 XChaCha20-Poly1305 is a variant of the ChaCha20-Poly1305 AEAD 118 construction as defined in [RFC7539] that uses a 192-bit nonce 119 instead of a 96-bit nonce. 121 The algorithm for XChaCha20-Poly1305 is as follows: 123 1. Calculate a subkey from the first 16 bytes of the nonce and the 124 key, using HChaCha20 (Section 2.2). 126 2. Use the subkey and remaining 8 bytes of the nonce (prefixed with 127 4 NUL bytes) with AEAD_CHACHA20_POLY1305 from [RFC7539] as 128 normal. The definition for XChaCha20 is given in Section 2.3. 130 XChaCha20-Poly1305 implementations already exist in WireGuard [4], 131 libsodium [5], xsecretbox [6], Tink [7], and in Go's crypto/ 132 chacha20poly1305 [8] library. 134 Similarly, Google's HPolyC [9] implements XChaCha12. 136 LibreSSL [10] has already implemented XChaCha20-Poly1305. 138 Note that the construction we're building upon uses the IETF's 139 ChaCha20 (96-bit nonce), not Bernstein's ChaCha20 (64-bit nonce). 141 2.1. Motivation for XChaCha20-Poly1305 143 The nonce used by the original ChaCha20-Poly1305 is too short to 144 safely use with random strings for long-lived keys. 145 XChaCha20-Poly1305 does not have this restriction. 147 By generating a subkey from a 128-bit nonce and the key, a reuse of 148 only the latter 64 bits of the nonce isn't security-affecting, since 149 the key (and thus, keystream) will be different. Additionally a re- 150 use of only the first 128 bits of the nonce isn't security-affecting, 151 as the nonce derived from the latter 64 bits is different. 153 Assuming a secure random number generator, random 192-bit nonces 154 should experience a single collision (with probability 50%) after 155 roughly 2^96 messages (approximately 7.2998163e+28). A more 156 conservative threshold (2^-32 chance of collision) still allows for 157 2^80 messages to be sent under a single key. 159 Therefore, with XChaCha20-Poly1305, users can safely generate a 160 random 192-bit nonce for each message and not worry about nonce-reuse 161 vulnerabilities. 163 As long as ChaCha20-Poly1305 is a secure AEAD cipher and ChaCha is a 164 secure pseudorandom function (PRF), XChaCha20-Poly1305 is secure. 166 2.2. HChaCha20 168 *HChaCha20* is an intermediary step towards XChaCha20 based on the 169 construction and security proof used to create XSalsa20 [11], an 170 extended-nonce Salsa20 variant used in NaCl [12]. 172 HChaCha20 is initialized the same way as the ChaCha cipher, except 173 that HChaCha20 uses a 128-bit nonce and has no counter. Instead, the 174 block counter is replaced by the first 32 bits of the nonce. 176 Consider the two figures below, where each non-whitespace character 177 represents one nibble of information about the ChaCha states (all 178 numbers little-endian): 180 cccccccc cccccccc cccccccc cccccccc 181 kkkkkkkk kkkkkkkk kkkkkkkk kkkkkkkk 182 kkkkkkkk kkkkkkkk kkkkkkkk kkkkkkkk 183 bbbbbbbb nnnnnnnn nnnnnnnn nnnnnnnn 185 ChaCha20 State: c=constant k=key b=blockcount n=nonce 186 cccccccc cccccccc cccccccc cccccccc 187 kkkkkkkk kkkkkkkk kkkkkkkk kkkkkkkk 188 kkkkkkkk kkkkkkkk kkkkkkkk kkkkkkkk 189 nnnnnnnn nnnnnnnn nnnnnnnn nnnnnnnn 191 HChaCha20 State: c=constant k=key n=nonce 193 After initialization, proceed through the ChaCha rounds as usual. 195 Once the 20 ChaCha rounds have been completed, the first 128 bits and 196 last 128 bits of the ChaCha state (both little-endian) are 197 concatenated, and this 256-bit subkey is returned. 199 2.2.1. Test Vector for the HChaCha20 Block Function 201 o Key = 00:01:02:03:04:05:06:07:08:09:0a:0b:0c:0d:0e:0f:10:11:12:13: 202 14:15:16:17:18:19:1a:1b:1c:1d:1e:1f. The key is a sequence of 203 octets with no particular structure before we copy it into the 204 HChaCha state. 206 o Nonce = (00:00:00:09:00:00:00:4a:00:00:00:00:31:41:59:27) 208 After setting up the HChaCha state, it looks like this: 210 61707865 3320646e 79622d32 6b206574 211 03020100 07060504 0b0a0908 0f0e0d0c 212 13121110 17161514 1b1a1918 1f1e1d1c 213 09000000 4a000000 00000000 27594131 215 ChaCha state with the key setup. 217 After running 20 rounds (10 column rounds interleaved with 10 218 "diagonal rounds"), the HChaCha state looks like this: 220 423b4182 fe7bb227 50420ed3 737d878a 221 0aa76448 7954cdf3 846acd37 7b3c58ad 222 77e35583 83e77c12 e0076a2d bc6cd0e5 223 d5e4f9a0 53a8748a 13c42ec1 dcecd326 225 HChaCha state after 20 rounds 227 HChaCha20 will then return only the first and last rows, in little 228 endian, resulting in the following 256-bit key: 230 82413b42 27b27bfe d30e4250 8a877d73 231 a0f9e4d5 8a74a853 c12ec413 26d3ecdc 233 Resultant HChaCha20 subkey 235 2.3. XChaCha20 237 XChaCha20 can be constructed from an existing ChaCha20 implementation 238 and HChaCha20. All one needs to do is: 240 1. Pass the key and the first 16 bytes of the 24-byte nonce to 241 HChaCha20 to obtain the subkey. 243 2. Use the subkey and remaining 8 byte nonce with ChaCha20 as normal 244 (prefixed by 4 NUL bytes, since [RFC7539] specifies a 12-byte 245 nonce). 247 XChaCha20 is a stream cipher and offers no integrity guarantees 248 without being combined with a MAC algorithm (e.g. Poly1305). 250 The same HChaCha20 subkey derivation can also be used in the context 251 of an AEAD_ChaCha20_Poly1305 implementation to create 252 AEAD_XChaCha20_Poly1305, as described in Section 2. Note that, with 253 the AEAD mode, the initial block counter is set to 1 instead of 0, 254 since the first block is used to derive the one-time Poly1305 key. 256 2.3.1. XChaCha20 Pseudocode 258 xchacha20_encrypt(key, nonce, plaintext): 259 subkey = hchacha20(key, nonce[0:15]) 260 chacha20_nonce = "\x00\x00\x00\x00" + nonce[16:23] 261 blk_ctr = 0 262 return chacha20_encrypt(subkey, chacha20_nonce, plaintext, blk_ctr) 264 3. Security Considerations 266 The security of the XChaCha construction depends on both the security 267 of the ChaCha stream cipher and the HChaCha intermediary step, for 268 reasons explained in the XSalsa20 paper [13] (which our XChaCha 269 construction is derived from). 271 Given that the 20-round ChaCha stream cipher (ChaCha20) is believed 272 to be at least as secure as Salsa20, our only relevant security 273 consideration involves HChaCha20. 275 3.1. Proving XChaCha20 to be Secure 277 In the XSalsa20 paper, when HSalsa20 is defined, the author states, 278 "The indices 0, 5, 10, 15, 6, 7, 8, 9 here were not chosen 279 arbitrarily; the choice is important for the security proof later in 280 this paper." 281 In the analysis of Theorem 3.1 from the same paper (which covers 282 generalized cascades), the author further states: "Note that this 283 bound is affected less by the insecurity of H than by the insecurity 284 of S." 286 This means that the security of HSalsa20 affects the security of 287 XSalsa20 less than Salsa20 does, and the same applies to any 288 generalized cascade following a similar construction. 290 However, we want to be sure that HChaCha is secure even if it's less 291 security-affecting than ChaCha (which we already believe to be 292 secure). 294 In Salsa20, the indices 0, 5, 10, 15 were populated with constants, 295 while the indices 6, 7, 8, and 9 were populated by the nonce. The 296 security proof for HSalsa20 relies on the definition of a function Q 297 (specified in Theorem 3.3 of the paper) that provides two critical 298 properties: 300 1. Q(i) is a public computation of H(i) and S(i). 302 2. Q(i) is a public computation of uniform random strings from 303 uniform random strings. 305 Thus, HSalsa20 uses the same indices as the public inputs (constant + 306 nonce) for its final output. 308 The reliance on public computation for the security proof makes 309 sense, and can be applied to ChaCha with a slight tweak. 311 ChaCha is a slightly different construction than Salsa20: The 312 constants occupy the indices at 0, 1, 2, 3. Meanwhile, the nonce 313 populates indices 12, 13, 14, 15. 315 Consequently, we can extract a public computation from ChaCha20 by 316 selecting these indices from HChaCha20's final state as the HChaCha20 317 output, and the same security proof can be used. 319 Therefore, if the argument that makes HSalsa20 secure is valid, then 320 it also applies to HChaCha for the corresponding output indices. 322 HSalsa20: 0, 5, 10, 15, 6, 7, 8, 9 323 HChaCha: 0, 1, 2, 3, 12, 13, 14, 15 325 Input and output indices for the relevant security proof 327 If the 20-round HChaCha (HChaCha20) is secure, and the 20-round 328 ChaCha20 is secure, then XChaCha20 is also secure. 330 4. IANA Considerations 332 This document defines a new stream cipher ("XChaCha20", see 333 Section 2.3) and a new AEAD cipher construction 334 ("XChaCha20-Poly1305", see Section 2). 336 A new entry in the "Authenticated Encryption with Associated Data 337 (AEAD) Parameters" registry with the name "AEAD_XCHACHA20_POLY1305" 338 should be assigned. 340 Name | Reference | Number Identifier 341 ------------------------+-----------+------------------ 342 AEAD_XCHACHA20_POLY1305 | Section 2 | TBD1 344 5. References 346 5.1. Normative References 348 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 349 Requirement Levels", BCP 14, RFC 2119, 350 DOI 10.17487/RFC2119, March 1997, 351 . 353 [RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data 354 Encodings", RFC 4648, DOI 10.17487/RFC4648, October 2006, 355 . 357 [RFC5297] Harkins, D., "Synthetic Initialization Vector (SIV) 358 Authenticated Encryption Using the Advanced Encryption 359 Standard (AES)", RFC 5297, DOI 10.17487/RFC5297, October 360 2008, . 362 [RFC7539] Nir, Y. and A. Langley, "ChaCha20 and Poly1305 for IETF 363 Protocols", RFC 7539, DOI 10.17487/RFC7539, May 2015, 364 . 366 5.2. URIs 368 [1] https://cryptologie.net/article/361/breaking-https-aes-gcm-or-a- 369 part-of-it/ 371 [2] https://eprint.iacr.org/2017/168.pdf 373 [3] https://competitions.cr.yp.to/caesar-submissions.html 375 [4] https://www.wireguard.com 377 [5] https://download.libsodium.org/doc/secret-key_cryptography/ 378 xchacha20-poly1305_construction.html 380 [6] https://github.com/jedisct1/xsecretbox 382 [7] https://github.com/google/tink 384 [8] https://godoc.org/golang.org/x/crypto/chacha20poly1305#NewX 386 [9] https://github.com/google/hpolyc 388 [10] https://github.com/libressl-portable/openbsd/commit/ 389 f9ad715107c72ecbd84924fa7268f4d4686c9e43#diff- 390 e67c04cb298e3a810d8d68c7893942be 392 [11] https://cr.yp.to/snuffle/xsalsa-20110204.pdf 394 [12] https://nacl.cr.yp.to 396 [13] https://cr.yp.to/snuffle/xsalsa-20110204.pdf 398 Appendix A. Additional Test Vectors 400 A.1. Example and Test Vector for AEAD_XCHACHA20_POLY1305 402 Plaintext: 404 000 4c 61 64 69 65 73 20 61 6e 64 20 47 65 6e 74 6c Ladies and Gentl 405 016 65 6d 65 6e 20 6f 66 20 74 68 65 20 63 6c 61 73 emen of the clas 406 032 73 20 6f 66 20 27 39 39 3a 20 49 66 20 49 20 63 s of '99: If I c 407 048 6f 75 6c 64 20 6f 66 66 65 72 20 79 6f 75 20 6f ould offer you o 408 064 6e 6c 79 20 6f 6e 65 20 74 69 70 20 66 6f 72 20 nly one tip for 409 080 74 68 65 20 66 75 74 75 72 65 2c 20 73 75 6e 73 the future, suns 410 096 63 72 65 65 6e 20 77 6f 75 6c 64 20 62 65 20 69 creen would be i 411 112 74 2e t. 413 AAD: 415 000 50 51 52 53 c0 c1 c2 c3 c4 c5 c6 c7 PQRS........ 417 Key: 419 000 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f ................ 420 016 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f ................ 422 IV: 424 000 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f @ABCDEFGHIJKLMNO 425 016 50 51 52 53 54 55 56 57 PQRSTUVW 427 32-bit fixed-common part: 429 000 00 00 00 00 .... 431 Poly1305 Key: 433 000 7b 19 1f 80 f3 61 f0 99 09 4f 6f 4b 8f b9 7d f8 {....a...OoK..}. 434 016 47 cc 68 73 a8 f2 b1 90 dd 73 80 71 83 f9 07 d5 G.hs.....s.q.... 436 Ciphertext: 438 000 bd 6d 17 9d 3e 83 d4 3b 95 76 57 94 93 c0 e9 39 .m..>..;.vW....9 439 016 57 2a 17 00 25 2b fa cc be d2 90 2c 21 39 6c bb W*..%+.....,!9l. 440 032 73 1c 7f 1b 0b 4a a6 44 0b f3 a8 2f 4e da 7e 39 s....J.D.../N.~9 441 048 ae 64 c6 70 8c 54 c2 16 cb 96 b7 2e 12 13 b4 52 .d.p.T.........R 442 064 2f 8c 9b a4 0d b5 d9 45 b1 1b 69 b9 82 c1 bb 9e /......E..i..... 443 080 3f 3f ac 2b c3 69 48 8f 76 b2 38 35 65 d3 ff f9 ??.+.iH.v.85e... 444 096 21 f9 66 4c 97 63 7d a9 76 88 12 f6 15 c6 8b 13 !.fL.c}.v....... 445 112 b5 2e .. 447 Tag: 449 c0:87:59:24:c1:c7:98:79:47:de:af:d8:78:0a:cf:49 451 A.2. Example and Test Vectors for XChaCha20 453 Note: This is for the XChaCha20 stream cipher itself, not the AEAD 454 construction. 456 A.2.1. With Block Counter = 0 458 Counter: 0 460 Plaintext: 462 000 54 68 65 20 64 68 6f 6c 65 20 28 70 72 6f 6e 6f The dhole (prono 463 010 75 6e 63 65 64 20 22 64 6f 6c 65 22 29 20 69 73 unced "dole") is 464 020 20 61 6c 73 6f 20 6b 6e 6f 77 6e 20 61 73 20 74 also known as t 465 030 68 65 20 41 73 69 61 74 69 63 20 77 69 6c 64 20 he Asiatic wild 466 040 64 6f 67 2c 20 72 65 64 20 64 6f 67 2c 20 61 6e dog, red dog, an 467 050 64 20 77 68 69 73 74 6c 69 6e 67 20 64 6f 67 2e d whistling dog. 468 060 20 49 74 20 69 73 20 61 62 6f 75 74 20 74 68 65 It is about the 469 070 20 73 69 7a 65 20 6f 66 20 61 20 47 65 72 6d 61 size of a Germa 470 080 6e 20 73 68 65 70 68 65 72 64 20 62 75 74 20 6c n shepherd but l 471 090 6f 6f 6b 73 20 6d 6f 72 65 20 6c 69 6b 65 20 61 ooks more like a 472 0a0 20 6c 6f 6e 67 2d 6c 65 67 67 65 64 20 66 6f 78 long-legged fox 473 0b0 2e 20 54 68 69 73 20 68 69 67 68 6c 79 20 65 6c . This highly el 474 0c0 75 73 69 76 65 20 61 6e 64 20 73 6b 69 6c 6c 65 usive and skille 475 0d0 64 20 6a 75 6d 70 65 72 20 69 73 20 63 6c 61 73 d jumper is clas 476 0e0 73 69 66 69 65 64 20 77 69 74 68 20 77 6f 6c 76 sified with wolv 477 0f0 65 73 2c 20 63 6f 79 6f 74 65 73 2c 20 6a 61 63 es, coyotes, jac 478 100 6b 61 6c 73 2c 20 61 6e 64 20 66 6f 78 65 73 20 kals, and foxes 479 110 69 6e 20 74 68 65 20 74 61 78 6f 6e 6f 6d 69 63 in the taxonomic 480 120 20 66 61 6d 69 6c 79 20 43 61 6e 69 64 61 65 2e family Canidae. 482 Key: 484 000 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f ................ 485 016 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f ................ 487 IV: 489 000 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f @ABCDEFGHIJKLMNO 490 016 50 51 52 53 54 55 56 58 PQRSTUVX 491 Keystream: 493 000: 11 31 ce 9a 2a 20 ae 0d 67 c8 93 5c 77 89 fa 10 .1..* ..g..\w... 494 010: 25 c9 e5 bb 72 0f b9 6f 11 35 4f b9 7a f0 bd 9a %...r..o.5O.z... 495 020: ad ec 08 63 ba 60 ca c8 58 2c 48 f8 6c df c4 8e ...c.`..X,H.l... 496 030: dd 46 a4 86 42 c5 de 62 cc f1 1c 7b 21 bf 33 7d .F..B..b...{!.3} 497 040: 29 62 4b 4b 1b 14 0a ce 53 74 0e 40 5b 21 68 54 )bKK....St.@[!hT 498 050: 0f d7 d6 30 c1 f5 36 fe cd 72 2f c3 cd db a7 f4 ...0..6..r/..... 499 060: cc a9 8c f9 e4 7e 5e 64 d1 15 45 0f 9b 12 5b 54 .....~^d..E...[T 500 070: 44 9f f7 61 41 ca 62 0a 1f 9c fc ab 2a 1a 8a 25 D..aA.b.....*..% 501 080: 5e 76 6a 52 66 b8 78 84 61 20 ea 64 ad 99 aa 47 ^vjRf.x.a .d...G 502 090: 94 71 e6 3b ef cb d3 7c d1 c2 2a 22 1f e4 62 21 .q.;...|..*"..b! 503 0a0: 5c f3 2c 74 89 5b f5 05 86 3c cd dd 48 f6 29 16 \.,t.[...<..H.). 504 0b0: dc 65 21 f1 ec 50 a5 ae 08 90 3a a2 59 d9 bf 60 .e!..P....:.Y..` 505 0c0: 7c d8 02 6f ba 54 86 04 f1 b6 07 2d 91 bc 91 24 |..o.T.....-...$ 506 0d0: 3a 5b 84 5f 7f d1 71 b0 2e dc 5a 0a 84 cf 28 dd :[._..q...Z...(. 507 0e0: 24 11 46 bc 37 6e 3f 48 df 5e 7f ee 1d 11 04 8c $.F.7n?H.^...... 508 0f0: 19 0a 3d 3d eb 0f eb 64 b4 2d 9c 6f de ee 29 0f ..==...d.-.o..). 509 100: a0 e6 ae 2c 26 c0 24 9e a8 c1 81 f7 e2 ff d1 00 ...,&.$......... 510 110: cb e5 fd 3c 4f 82 71 d6 2b 15 33 0c b8 fd cf 00 ...