1
$\begingroup$

Do I understand correctly that XSalsa20 + Poly1305 provides authentication without a tag? If so, then how does that work?

I came to that conclusion by reading http://nacl.cr.yp.to/secretbox.html, "Secret-key authenticated encryption", where it states (as far as I understand) that the ciphertext has the same length as the plaintext.

Improve this question
$\endgroup$
5
  • $\begingroup$ Where did you see that it has no tag for authentication? The Poly1305 is producing the authentication tag. $\endgroup$
    – kelalaka
    Dec 14, 2020 at 13:32
  • $\begingroup$ @kelalaka I think its the wording here " The crypto_secretbox function puts the ciphertext into c[0], c[1], ..., c[mlen-1]. It then returns 0" $\endgroup$
    – Modal Nest
    Dec 14, 2020 at 13:35
  • 1
    $\begingroup$ @ModalNest The doc misleading see libsodium.gitbook.io/doc/secret-key_cryptography/secretbox $\endgroup$
    – kelalaka
    Dec 14, 2020 at 13:36
  • 1
    $\begingroup$ @kelalaka Yeah agree re the doc. OP you can find an online demo of secretbox here. $\endgroup$
    – Modal Nest
    Dec 14, 2020 at 13:47
  • $\begingroup$ @ModalNest, I think what he means is that the message needs to be padded with 32 bytes of zeroes, and that message will be encrypted into ciphertext, out of which the first 16 bytes will be zero, therefore the following 16 are likely the tag. $\endgroup$
    – Hashi Oki
    Dec 14, 2020 at 19:42

1 Answer 1

Reset to default
2
$\begingroup$

The documentation is a bit misleading about crypto_secretbox_xsalsa20poly1305 that uses a 16-byte authentication tag of poly1305. The libsodium has more clear explanation on it. From Bernstein' paper's abstract;

Poly1305-AES computes a 16-byte authenticator of a variable-length message, using a 16-byte AES key, a 16-byte additional key, and a 16-byte nonce

I would be surprised that one authenticates an arbitrary message without using a MAC tag (Wikipedia quote);

In cryptography, a message authentication code (MAC), sometimes known as a tag, is a short piece of information used to authenticate a message—in other words, to confirm that the message came from the stated sender (its authenticity) and has not been changed.

Therefore the short piece of information must be somewhere!.

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ Thanks, that makes a lot more sense. Indeed, I find DJB's software a bit confusing. $\endgroup$
    – Hashi Oki
    Dec 14, 2020 at 19:34
  • $\begingroup$ Reading from multiple sources, if exists, can enlighten. $\endgroup$
    – kelalaka
    Dec 14, 2020 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.