2
$\begingroup$

I have a PSK. I don't want to use it directly. I want to pass a "salt"/password into a KDF and get a new key for authenticated encryption with ChaCha20-Poly1305 .

I need to give the other side the nonce used.

I don't have enough space to fit all of this in a packet.

My plan was to generate a random nonce. But then thought...

Is it bad to use my pass/salt (16 bytes) as the nonce (12 bytes) as well? I could save the space of sending the nonce by just lopping 4 bytes off the salt.

I know all about the dangers of reusing a nonce. But I'm not sure it applies here because my "old PSK" is thrown into the KDF with the salt/pass so does it matter if that also makes up the nonce?

$\endgroup$
  • 2
    $\begingroup$ ChaCha IVs are allowed to be non-random. If you're going to use a constant (remember that then you'd need to derive a new key for every session), then you may as well use zero. $\endgroup$ – Future Security Feb 22 at 1:38
  • $\begingroup$ Good point. I kinda forgot you can reuse a nonce if you aren’t reusing the key. Hmm. I’ll have to think about the possible attacks with this, but I may end up going this route. $\endgroup$ – jumpifnot0 Feb 22 at 2:50
4
$\begingroup$

If you have a PSK then you don't need a password. You can just derive new session keys from the PSK, e.g. using a salt within HKDF. It is also possible to derive a key and IV if you're already using a salt. You could also use a counter starting at zero as nonce / IV instead because the resulting key is considered "fresh".

Generally, you simply need a unique key nonce combination for any encryption operation for stream ciphers. If you always apply a random salt to derive both than that requirement is fulfilled, because the key is always fresh. Reusing the salt is however immediately fatal to the security, so the salt should consist of say, 12 bytes / 96 bits or more generated by a secure random number generator.


Using a random salt together with a PBKDF is also possible, but as indicated, I'm not sure if you need a password and therefore a password stretching function such as a password hash / PBKDF.

|improve this answer|||||
$\endgroup$
  • $\begingroup$ When I used "pass" it was as salt into a KDF like PBKDF which might not be "exactly" what I need, but there are a lot of C sources available. HKDF is better! OK... So If I roll a random salt and transmit that plaintext with an AEAD tag that was made with my new session key (where KDF+PSK+SALT == NEWKEY)... And I know the salt was random, does that also satisfy the nonce requirement? THEN can I use that newkey with random nonces for the rest of this session? I think this is ok because the nonce despite being the same bytes as the salt is not related to the KDF+PSK+SALT. $\endgroup$ – jumpifnot0 Feb 22 at 0:18
  • 1
    $\begingroup$ If the key is always different then the nonce requirement is fulfilled anyway. As long as you don't mix IV/nonce and key information you should be fine. As far as ChaCha20 goes, I think it "just" requires a unique nonce (for each key) so I don't think it is that strict. $\endgroup$ – Maarten Bodewes Feb 22 at 0:23
  • $\begingroup$ Ok, I think I'm fine with this. The theoretical issue was that if I'm using that salt as input the HKDF AND as the nonce that might be a weakness but, no, its not. I don't plan on using a new key every communication. Just this once to establish a new session key (SALT+HKDF+OLDPSK). And then using unique nonces from there on out. The issue is that I don't have enough packet side to transit a nonce + salt + the rest of the packet. So I was hoping to just "infer" nonce by using salt for the first message. $\endgroup$ – jumpifnot0 Feb 22 at 0:28
  • 1
    $\begingroup$ Which is fine. You could even use it as starting point of a counter, but beware that you don't accept the wrong messages (break on partial decrypt, resend etc.) $\endgroup$ – Maarten Bodewes Feb 22 at 0:34
  • $\begingroup$ @kelalaka Yes, you’re right. It’s not just ChaCha20, but ChaCha20-Poly1305 as AEAD. $\endgroup$ – jumpifnot0 Feb 22 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.