None of the implementations of ChaCha20-Poly1305 AEAD scheme I've seen so far provide a streaming API. Instead, ChaCha20-Poly1305 is presented as an inseparable combination, closely adhering to the pseudocode from the section 2.8 of "ChaCha20 and Poly1305 for IETF Protocols", which requires the plaintext message to be fully loaded into memory. I would prefer to avoid that in case the input becomes very large (but still finite and with a known size). (I know I could split the message up, but I want to avoid that, too)

I'm starting to wonder if it's at all possible to provide a streaming API to that scheme? If not, why?

  • $\begingroup$ Poly1305 must be computed over the entire message, it's not a streaming authenticator. It's normally easiest to make fixed-length packets, with sequence numbers, and authenticate those independently. $\endgroup$ – SAI Peregrinus Jan 8 '18 at 4:08

This is not specific to this construction, but generally, you want to split the stream in smaller chunks, that are individually encrypted and authenticated.

If the encrypted stream doesn't have a valid authentication tag, this is not something you want to discover at the very end, after having decrypted terabytes of data.

Some precautions have to be taken when splitting a stream into chunks. Namely, you need to make sure that chunks haven't been reordered, removed, duplicated and you need a way to verify that the last chunk you read was meant to be the end of the stream.

The encrypting a sequence or a set of dependent messages page in the libsodium documentation provides some guidance for this, as well as a streaming API using Chacha20-Poly1305.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.