Subject: [saag] What does it mean to resynchronize RFC 7539 ChaCha?

From: Jeffrey Walton <[email-masked]>
Date: Mon, 12 Sep 2016 22:06:09 -0400

I'm working on a test suite that includes RFC 7539 ChaCha. The IETF's
implementation is mildly different from Bernstein's ChaCha, and I want
to make sure the test suite behaves as expected.

If one performs a resynchronize on IETF ChaCha, does it: (1) reset
block counter + apply new IV; or (2) apply new IV? Or maybe something
else?

Thanks in advance.

jeff

---

From: Yoav Nir <[email-masked]>
Date: Thu, 15 Sep 2016 08:57:38 +0300

Hi, Jeff

> On 13 Sep 2016, at 5:06 AM, Jeffrey Walton <[email-masked]> wrote:
> 

Yes. the original ChaCha received a 64-bit nonce and included a 64-bit block counter. This allows for 2^64 encryptions, each of 2^64 blocks. Each block is 512 bit or 64 octets, so you can have plaintexts as big as 2^70 octets. We changed that so that the nonce is 96-bit and the block counter is 32-bit, limiting the size of the plaintext to 2^38 octets or 256 GB.

This choice was motivated by several reasons:
 1. RFC 5119 requires a 96-bit nonce
 2. AES-GCM already had a 96-bit nonce
 3. Although a single key is rarely used for more than 2^64 encryptions, it’s sometimes necessary to partition the nonce space. Consider multi-sender group IPsec (RFC 6407)
 4. For most things interesting to the IETF, 256 GB is more than enough. IPsec packets and TLS records are under 64KB and MIME entities are typically smaller than that.

This is limit. 256 GB is not enough to encrypt all files with one encryption operation. But we thought it would be a better fit for IETF protocols.

> block counter + apply new IV; or (2) apply new IV? Or maybe something

Not sure what you mean by resynchronize. But if you mean changing the nonce, then yes, the block counter resets to zero.

Note that all uses of RFC 7539, including the TLS draft and IPsec RFC do not use ChaCha alone, but the ChaCha20-Poly1305 AEAD. In that construction the block counter of zero is used to generate the one-time Poly1305 key, and encryption begins with block counter 1.

HTH

Yoav