All of lore.kernel.org
 help / color / mirror / Atom feed
From: Martin Willi <martin@strongswan.org>
To: Eric Biggers <ebiggers3@gmail.com>,
	Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: David Gstir <david@sigma-star.at>, Theodore Ts'o <tytso@mit.edu>,
	herbert@gondor.apana.org.au, Eric Biggers <ebiggers@google.com>,
	Stephan Mueller <smueller@chronox.de>,
	Michael Halcrow <mhalcrow@google.com>,
	"Jason A . Donenfeld" <Jason@zx2c4.com>,
	linux-f2fs-devel@lists.sourceforge.net,
	linux-fscrypt@vger.kernel.org, linux-mtd@lists.infradead.org,
	linux-crypto@vger.kernel.org, linux-fsdevel@vger.kernel.org,
	Jaegeuk Kim <jaegeuk@kernel.org>,
	linux-ext4@vger.kernel.org, Paul Crowley <paulcrowley@google.com>
Subject: Re: [RFC PATCH] crypto: chacha20 - add implementation using 96-bit nonce
Date: Mon, 11 Dec 2017 08:38:45 +0100	[thread overview]
Message-ID: <1512977925.28078.12.camel@strongswan.org> (raw)
In-Reply-To: <20171208221716.GB104193@gmail.com>

Hi,

> Anyway, I actually thought it was intentional that the ChaCha
> implementations in the Linux kernel allowed specifying the block
> counter, and therefore allowed seeking to any point in the keystream,
> exposing the full functionality of the cipher.

If I remember correctly, it was indeed intentional. When building the
chacha20poly1305 AEAD both in [1] and [2], a block counter of 0 is used
to generate the Poly1305 key. For the ChaCha20 encryption, an explicit
initial block counter of 1 is used to avoid reusing the same counter.

Maybe it would be possible to implement this with implicit counters,
but doing this explicitly looked much clearer to me. So I guess there
are use cases for explicit block counters in ChaCha20.

Best regards
Martin

[1] https://tools.ietf.org/html/rfc7539#section-2.8
[2] https://tools.ietf.org/html/rfc7634#section-2

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

WARNING: multiple messages have this Message-ID (diff)
From: Martin Willi <martin@strongswan.org>
To: Eric Biggers <ebiggers3@gmail.com>,
	Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: linux-crypto@vger.kernel.org, herbert@gondor.apana.org.au,
	Eric Biggers <ebiggers@google.com>,
	linux-fscrypt@vger.kernel.org, Theodore Ts'o <tytso@mit.edu>,
	linux-ext4@vger.kernel.org,
	linux-f2fs-devel@lists.sourceforge.net,
	linux-mtd@lists.infradead.org, linux-fsdevel@vger.kernel.org,
	Jaegeuk Kim <jaegeuk@kernel.org>,
	Michael Halcrow <mhalcrow@google.com>,
	Paul Crowley <paulcrowley@google.com>,
	David Gstir <david@sigma-star.at>,
	"Jason A . Donenfeld" <Jason@zx2c4.com>,
	Stephan Mueller <smueller@chronox.de>
Subject: Re: [RFC PATCH] crypto: chacha20 - add implementation using 96-bit nonce
Date: Mon, 11 Dec 2017 08:38:45 +0100	[thread overview]
Message-ID: <1512977925.28078.12.camel@strongswan.org> (raw)
In-Reply-To: <20171208221716.GB104193@gmail.com>

Hi,

> Anyway, I actually thought it was intentional that the ChaCha
> implementations in the Linux kernel allowed specifying the block
> counter, and therefore allowed seeking to any point in the keystream,
> exposing the full functionality of the cipher.

If I remember correctly, it was indeed intentional. When building the
chacha20poly1305 AEAD both in [1] and [2], a block counter of 0 is used
to generate the Poly1305 key. For the ChaCha20 encryption, an explicit
initial block counter of 1 is used to avoid reusing the same counter.

Maybe it would be possible to implement this with implicit counters,
but doing this explicitly looked much clearer to me. So I guess there
are use cases for explicit block counters in ChaCha20.

Best regards
Martin

[1] https://tools.ietf.org/html/rfc7539#section-2.8
[2] https://tools.ietf.org/html/rfc7634#section-2

  parent reply	other threads:[~2017-12-11  7:38 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-12-08 11:55 [RFC PATCH] crypto: chacha20 - add implementation using 96-bit nonce Ard Biesheuvel
2017-12-08 22:17 ` Eric Biggers
2017-12-08 22:42   ` Ard Biesheuvel
2017-12-08 22:54     ` Ard Biesheuvel
2017-12-08 23:11       ` Eric Biggers
2017-12-08 23:27         ` Ard Biesheuvel
2017-12-11  7:38   ` Martin Willi [this message]
2017-12-11  7:38     ` Martin Willi
2017-12-11  6:55 ` Herbert Xu
2017-12-11  6:55   ` Herbert Xu
2017-12-11  6:55   ` Herbert Xu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1512977925.28078.12.camel@strongswan.org \
    --to=martin@strongswan.org \
    --cc=Jason@zx2c4.com \
    --cc=ard.biesheuvel@linaro.org \
    --cc=david@sigma-star.at \
    --cc=ebiggers3@gmail.com \
    --cc=ebiggers@google.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=jaegeuk@kernel.org \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-ext4@vger.kernel.org \
    --cc=linux-f2fs-devel@lists.sourceforge.net \
    --cc=linux-fscrypt@vger.kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-mtd@lists.infradead.org \
    --cc=mhalcrow@google.com \
    --cc=paulcrowley@google.com \
    --cc=smueller@chronox.de \
    --cc=tytso@mit.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.