7
$\begingroup$

Is the use of Poly1305 limited to stream ciphers? (note, I'm not talking about Poly1305-AES )? Can it be used with block ciphers running in CTR mode? If so, what other considerations/limitations are there? I like the simplicity of using a single key for encryption/authentication, but authenticated modes like GCM are limited to block ciphers.

Improve this question
$\endgroup$
1
  • 4
    $\begingroup$ A block cipher in CTR mode is a stream cipher. $\endgroup$
    – CodesInChaos
    Jun 13, 2013 at 0:29

1 Answer 1

Reset to default
4
$\begingroup$

Q2: No, Poly1305 not limited to stream ciphers. Yes, Poly1305 can be used with block ciphers running in CTR mode, if you use it appropriately.

I don't know whether the NaCl use is secure (whether NaCl uses it appropriately); I haven't tried to analyze NaCl. Given that NaCl was built by reputable cryptographers, I would be inclined to guess that it's probably fine. I realize this doesn't answer your full question.

Alternatively, if you were asking because you were thinking of designing your own scheme that makes use of Poly1305, my reaction is: if you're designing it, you should just use some reputable authenticated encryption scheme. From an engineering perspective, that's probably the best solution: it minimizes the chances you foul things up somehow. If you try to use Poly1305 in some custom way you design, the risk of introducing security problems is higher.

Improve this answer
$\endgroup$
2
  • $\begingroup$ @DW - I have no intention of designing my own scheme, but for lack of ample information/advice regarding Poly1305, I'll follow your advice and go with something more reputable (such as encrypt-then-HMAC) when GCM mode is not an option. I've been running some tests and it turns out that calculating a SHA256 HMAC is much faster than Poly1305 anyway, so there seems little reason to take the risk of using it. $\endgroup$
    – hunter
    Jun 13, 2013 at 19:14
  • 3
    $\begingroup$ @hunter - SHA256-HMAC being faster than Poly1305 sounds like a broken implementation of Poly1305. Even in the Java performance ghetto, you can get Poly1305 down to 7 cycle per byte, while SHA256-HMAC is in the 30-50 cycles per byte range. In my experience, Poly1305 is faster than all other MACs (including Skein, SipHash etc.). $\endgroup$
    – archie
    Oct 14, 2013 at 6:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.