I've been reading about Poly1305 as implemented in the NaCl library, more specifically I've been referring to this Java implementation of NaCl. My understanding of XSalsa20Poly1305 (in this implementation, at least) is that it prepends 32 zero-bytes to the clear-text, encrypts with XSalsa20 as per normal, uses the 32 encrypted zero-bytes as a the key for calculating a 16-byte Poly1305 MAC, and then discards the encrypted zero-bytes. Do I understand this correctly? Is this the standard way that Poly1305 is used?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
I don't know if this is the standard way, but I do know that poly1305 is a single-use-only MAC function. You can never use the same poly1305 key twice for different messages or an attacker could forge MACs, apparently. So this sounds like an easy, safe, and computationally inexpensive way to use the encryption cipher you're going to use anyway to generate a unique strongly-randomized poly1305 key for each message.