Poly1305-AES is a cryptographic message authentication code (MAC) written by Daniel J. Bernstein. It can be used to verify the data integrity and the authenticity of a message.

learn more… | top users | synonyms

0
votes
0answers
25 views

Poly1305 vs VMAC: is VMAC much better for long messages?

VMAC seems to me much more secure than Poly1305 on long messages (the security of the latter decreases linearly with increasing message length). Is this of practical relevance?
1
vote
0answers
13 views

Do Wegman-Carter authenticators allow key reuse if the authenticator result is kept secret?

Poly1305 (and GHASH) are secure authenticators, but only for one use. Thus, nonce reuse in Poly1305-AES, ChaCha20-Poly1305, and AES-GCM all reveal the authentication key. However, my understanding ...
1
vote
1answer
49 views

What happens if a nonce is reused in ChaCha20-Poly1305?

In ChaCha20-Poly1305, I know that reusing a nonce loses confidentiality and integrity for all messages encrypted with the (key, nonce) pair. However, is security affected for those messages encrypted ...
4
votes
1answer
178 views

Can Poly1305-AES be used with AES-256?

I'm reading through Bernstein's The Poly1305-AES message-authentication code. The MAC is predicated on 16-byte block ciphers like AES and produces 16-byte authentication tags. However, Bernstein does ...
2
votes
1answer
114 views

chacha20-poly1305 padding and length encoding

The AEAD construction for chacha20-poly1305 described in the IETF proposal encodes message lengths into the text that is to be hashed. The newer proposal goes further and pads associated data and ...
11
votes
3answers
255 views

Why is Poly1305 popular given its 'sudden death' properties?

ECDSA has the undesirable property that if a key pair reuses a nonce in a signing operation, the cryptosystem experiences catastrophic failure in the form of private key leakage. I've heard this ...
7
votes
1answer
122 views

Are poly1305 authenticators distinguishable from random data?

Assume Alice authenticates a message $M$ with nonce $N$ and secret key $K$, creating authenticator $A$. She then sends $A$ across the network. The Poly1305 paper does not seem to specify whether it ...
3
votes
2answers
173 views

What is the function of the secret key “r” in Poly1305?

Poly1305-AES uses two per-connection keys $k$ (for AES) and $r$ (for Poly1305's compression function) and a per-message nonce n to execute. I've read the original paper on the implementation, and I ...
6
votes
1answer
656 views

Why does NaCl's crypto_secretbox for xsalsa20-poly1305 require the first 32 bytes to be zero?

The NaCl web site says this is a requirement of the API, but its seems more than just an API issue. It means the first 32 bytes of the first salsa20 block are effectively ignored. I didn't see ...
6
votes
1answer
352 views

How does NaCL Poly1305 implementation do modular multiplication?

The NaCL ref implementation of Poly1305 performs modular multiplication to calculate a polynomial $\mod 2^{130} - 5$ using the following modular multiplication ...
2
votes
1answer
301 views

How does Poly1305 in the NaCl library calculate a MAC?

I've been reading about Poly1305 as implemented in the NaCl library, more specifically I've been referring to this Java implementation of NaCl. My understanding of XSalsa20Poly1305 (in this ...
6
votes
1answer
335 views

Can Poly1305 be used with block ciphers running in CTR mode?

Is the use of Poly1305 limited to stream ciphers? (note, I'm not talking about Poly1305-AES )? Can it be used with block ciphers running in CTR mode? If so, what other considerations/limitations are ...
6
votes
2answers
1k views

ChaCha cipher + Poly1305

The Poly1305-AES paper summarizes the MAC as $$ \mathrm{Poly1305}(m, \mathrm{AES}_k(n)) = {H_r(m) + \mathrm{AES}_k(n)} \mod 2^{128} $$ Can I presume that $+$ here is just meant as a form of 16-byte ...