Advantages of HS1-SIV over ChaCha20-Poly1305-SIV?

Question

What advantages does HS1-SIV have over ChaCha20-Poly1305-SIV?

I know that both use the ChaCha stream cipher, but I am trying to understand why HS1-Hash is a better MAC.

Edit: To hide the Poly1305 result I would use of the ChaCha20 core, a.k.a. HChaCha20, as a nonce-free but keyed PRF. This works because ChaCha20 is really a keyed hash in counter mode, and can also be used as a PRF directly. In fact, this is what XSalsa20 does with Salsa20 – it uses the Salsa20 core as a PRF to generate a 256 bit subkey from a 256 bit key and 128 bit nonce, the other 64 bits being used as the nonce for the subkey. Since HChaCha20 is a strong PRF (ChaCha20 is broken otherwise), I can just use it as a keyed 128->128 bit PRF, by discarding the top 128 bits.

Answer 1

ChaCha20-Poly1305-SIV is not well defined, and does not have the advantages of SIV-mode if you do define it.

The SIV mode is essentially MAC-then-encrypt, with the MAC reused as nonce. The MAC in ChaCha20-Poly1305 requires a nonce, because it uses ChaCha20 to encrypt the Poly1305 authenticator (you cannot reveal the raw authenticator). So you cannot use it to derive a nonce without already having a nonce.

You can use a version of SIV where a nonce is included in the MAC calculation, but then you do not gain any nonce-reuse resistance – the MAC is broken with nonce-reuse. You also have the problem (not insurmountable) of defining how the 128-bit MAC is used as a nonce to an encryption algorithm that only takes a 96-bit nonce.

Essentially, then, there is no advantage of using the SIV mode over just using ChaCha20-Poly1305, and the clear disadvantages of performance and complexity. HS1-SIV solves this by generating new keys using a hash of the message instead. This means that nonce misuse is not the end of the world.

---

With the updated question, where the MAC is Poly1305 and a PRF applied to it, the requirement of a strong nonce is lessened. However, unless you do include a nonce, you get worse bounds so you would still want a nonce (also to make it non-deterministic, if you want that).

In that case the advantages of HS1-SIV are not so clear. However, it is hopefully a somewhat better analyzed construction – or will be if it does well in CAESAR. It also offers different parameter options, the highest of which uses a hash larger than the 128-bits you are limited to with Poly1305. That means a lower probability of collision, and a higher number of messages before running into the birthday bound.

Again, you would still need to define how a 128-bit nonce will be used in ChaCha20, how or if associated data is authenticated, etc., but it seems like a reasonable option to HS1-SIV's middle set of parameters. The main advantage of HS1-Hash, then, is its flexibility.

(I do not know if it has performance advantages, but it seems possible that especially with short messages it would have an advantage over using an extra ChaCha call as a PRF.)