Nonce encryption with Poly1305-Chacha20

Question

I have seen that a couple of companies (like Google, Apple HomeKit) are adding "ChaCha20-Poly1305" as an encryption option.

Poly1305 requires algorithm to encrypt the nonce. The Poly1305-AES specification uses the AES algorithm to encrypt the nonce, but also says "There is nothing special about AES here. One can replace AES with an arbitrary keyed function from an arbitrary set of nonces to 16-byte strings. This paper focuses on AES for concreteness."

Two questions:

1. Do all TLS cipher suites using "Chacha20-Poly1305" use Poly1305-AES? RFC7539 references AES as the nonce-encrypting algorithm, but also notes that other algorithms could be used.

2. Why is Chacha20 not used as the nonce-encrypting algorithm instead (Poly1305-Chacha20)? Would this cause a security flaw?

Thank you!

Answer 1

Do all TLS cipher suites using "ChaCha20-Poly1305" use Poly1305-AES?

Nope, AES is indeed replaced with ChaCha20 in TLS. The Poly1305 one-time key is generated pseudorandomly using the ChaCha20 block function. The ChaCha20-Poly1305 TLS cipher suite spec draft uses the AEAD construction from RFC 7539, which defines exactly how this works:

The ChaCha20 and Poly1305 primitives are combined into an AEAD that
takes a 256-bit key and 96-bit nonce as follows:

o  First, a Poly1305 one-time key is generated from the 256-bit key
   and nonce using the procedure described in Section 2.6.

and Section 2.6 describes how the block function is used to generate the key:

o  The 256-bit session integrity key is used as the ChaCha20 key.

o  The block counter is set to zero.

o  The protocol will specify a 96-bit or 64-bit nonce.  This MUST be
   unique per invocation with the same key, so it MUST NOT be
   randomly generated.

Interestingly, the same 256-bit key and 96-bit nonce that are used to generate the one-time Poly1305 key are also used to produce the ChaCha20 keystream during the encryption step. This would be a security problem, except for this little detail:

o  Next, the ChaCha20 encryption function is called to encrypt the
   plaintext, using the same key and nonce, and with the initial
   counter set to 1.

Essentially, the first block (block zero) of ChaCha20 keystream output is used as the Poly1305 one-time key, while the remaining blocks are used in the actual encryption. This is critical: without this separation, an attacker could determine the Poly1305 key.

You might wonder why the Poly1305 paper used AES in the first place. Poly1305 was published in 2005, around the same time Salsa20 (ChaCha20's predecessor) was introduced. I suspect Bernstein chose AES since it was considered the "gold standard" at the time, and Salsa20 had not yet received significant attention from cryptanalysts.

Answer 2

In your link next to the cipher suites with poly1305 you find a link to

http://www.iana.org/go/draft-ietf-tls-chacha20-poly1305

That in turn links to rfc7539 which in Section 2.6 describes generating the key for poly1305 using chacha20.

So my answers would be:

1. No.
2. It is being used so it's probably and hopefully not a problem.