5
$\begingroup$

In the Libsodium v1.0.12 and v1.0.13 Security Assessment one can read

The ChaCha20-Poly1305 implementation combines a stream cipher and is resistant to timing attacks by design. In addition, this particular construction has two additional variants implemented in libsodium: an IETF version [7] and one with an extended nonce (XChaCha20-Poly1305) [4]. One benefit of the XChaCha20Poly1305 construction is that it enables nonce misuse-resistant schemes.

However, I don't understand how XChaCha20-Poly1305 construction is nonce misuse-resistant.

From my understanding, XChaCha20 works as follows:

  1. Generates a 192-bit random nonce (6 32-bit words $nonce_0,...,nonce_5$)
  2. Build the initial block $B \leftarrow \begin{matrix} c_0 & c_1 & c_2 & c_3\\ k_0 & k_1 & k_2 &k_3\\ k_4 & k_5 & k_6 &k_7\\ nonce_0 & nonce_1 & nonce_2 & nonce_3 \end{matrix}$ where $c_i$ are constants and $k_i$ are key words
  3. Runs ChaCha without the final block addition $B' \leftarrow \mathtt{HChaCha20}(B)$
  4. Build the subblock $B'' \leftarrow \begin{matrix} c_0 & c_1 & c_2 & c_3\\ B'_0 & B'_1 & B'_2 &B'_3\\ B'_{12} & B'_{13} & B'_{14} &B'_{15}\\ counter_0 & counter_1 & nonce_4 & nonce_5 \end{matrix}$
  5. Runs ChaCha20 using $B''$.

In this way, using the same nonce will output the same keystream. However, as I understand, nonce-misuse resistance schemes ensure that a repeated random nonce doesn't result in plaintext compromise.

So it seems that when using XChaCha20-Poly1305 with random nonce, one can ensure that the probablity of a repeated nonce is negligible. But this is not the definition of a nonce miseuse-resistant scheme.

How to build a nonce misuse-resistant schemes using XChaCha20Poly1305?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
10
$\begingroup$

The documentation on libsodium AEAD constructions provides more details.

Namely, it lists Hk(random ‖ m) as a way to compute a synthetic XChaCha20 nonce. Even if random is not unique, the nonce is unlikely to be the same for different messages.

Even more relevant are the sections on nonce-misuse resistance and short nonces.

Note that like all other nonce-misuse resistance schemes, this requires two passes over the data.

Improve this answer
$\endgroup$
3
  • $\begingroup$ isn't this dangerous? Because of length-extension, if one encrypt m and m || pad || something with the same nonce (let's say by mistake). Then an observer who can guess something can detect that X || pad || something has been encrypted. $\endgroup$
    – David 天宇 Wong
    Commented Mar 8, 2019 at 4:12
  • $\begingroup$ if we play the game proof: In the beginning I ask you for the encryption of m. After I send you rand_msg and m || pad || something, you send me the encryption of one of them, I can tell which one. $\endgroup$
    – David 天宇 Wong
    Commented Mar 8, 2019 at 4:13
  • $\begingroup$ Note the requirement for the synthetic nonce: a keyed hash function. This suggests HMAC, which is immune to length extension attacks. In the context of the libsodium documentation, this refers to either the HMAC construction, or BLAKE2, which is also resistant against length extension attacks. $\endgroup$
    – Frank Denis
    Commented Mar 8, 2019 at 10:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.