Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been reading about Poly1305 as implemented in the NaCl library, more specifically I've been referring to this Java implementation of NaCl. My understanding of XSalsa20Poly1305 (in this implementation, at least) is that it prepends 32 zero-bytes to the clear-text, encrypts with XSalsa20 as per normal, uses the 32 encrypted zero-bytes as a the key for calculating a 16-byte Poly1305 MAC, and then discards the encrypted zero-bytes. Do I understand this correctly? Is this the standard way that Poly1305 is used?

share|improve this question

I don't know if this is the standard way, but I do know that poly1305 is a single-use-only MAC function. You can never use the same poly1305 key twice for different messages or an attacker could forge MACs, apparently. So this sounds like an easy, safe, and computationally inexpensive way to use the encryption cipher you're going to use anyway to generate a unique strongly-randomized poly1305 key for each message.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.