Questions tagged [poly1305]

Poly1305-AES is a cryptographic message authentication code (MAC) written by Daniel J. Bernstein. It can be used to verify the data integrity and the authenticity of a message.

Filter by
Sorted by
Tagged with
1
vote
0answers
47 views

Implement deterministic authenticated encryption using libsodium

Note: this is my first question on stack exchange, let me know if you miss some details to answer and I will edit the question accordingly Context I'm willing to create a git encryption tool (...
1
vote
2answers
53 views

Is nonce-less Encrypt-then-HMAC as secure as poly1305

While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
1
vote
0answers
21 views

Is Poly1305 enough for cascading ciphers? [duplicate]

ChaCha20 along with Poly1305 provides confidentiality and integrity. Now suppose I cascade AES on top of ChaCha20. Is it safe to assume that the Poly1305 MAC is still secure, even if I cascade ...
2
votes
2answers
99 views

Can I use ChaCha20-Poly1305 as my KDF?

I have two devices that use a PSK. One is embedded and extremely resource confined. I'm already using ChaCha20-Poly1305 so it would be "free" to reuse this. There is no transport encryption ...
1
vote
1answer
104 views

XSalsa20 + Poly1305 authentication wtihout tag

Do I understand correctly that XSalsa20 + Poly1305 provides authentication without a tag? If so, then how does that work? I came to that conclusion by reading http://nacl.cr.yp.to/secretbox.html, &...
2
votes
1answer
73 views

Which AES mode when using Poly1305-AES

I am reading DJ Bernstein's paper on the Poly1305-AES mac (https://cr.yp.to/mac/poly1305-20050329.pdf). I understand that AES is needed to provide the array s. In its paper on page 5 we can read: ...
1
vote
0answers
123 views

How to increase Poly1305 performance?

I was analysing the Chacha20 algorithm and the Poly1305 MAC generation from RFC 7539. It seems that the Chacha20 is quite faster compared to AES on CPUs without hardware support like AES-NI. But ...
7
votes
3answers
1k views

What should the nonce value be for client-side encryption?

I am using the following chacha20poly1305 Rust library to encrypt some data in a desktop application. The user provides the key, which never leaves their device, to locally encrypt some data, and then ...
2
votes
2answers
146 views

Forgery attack on Poly1305 when the key and nonce reused

Introduction: I've tried to find how reusing one-time key compromises itself but only found information that it breaks the encryption entirely, it is written everywhere. But since no methods to reuse ...
0
votes
0answers
103 views

Secretbox- algorithm Poly1305 and cipher Xsalsa20

I use Rclone, which uses Secretbox to authenticate and encrypt data. Secretbox uses the Poly1305 authentication algorithm and the Xsalsa20 symmetric flow cipher. This whole process takes some time (...
2
votes
1answer
241 views

Why is it secure to reuse key and nonce in ChaCha20-Poly1305 AEAD construction?

While looking at the ChaCha20 and Poly1305 AEAD construction as defined by RFC 8439, more precisely its use of the key and the nonce, I came up with the questions below. Maybe someone with some in-...
12
votes
3answers
3k views

What happened to Poly1305AES? Is it obsolete?

I've been told that Poly1305AES is a great choice of MAC for constrained (embedded) environments. I'd checked out DJB's writing on it briefly, and have to say that I found its simplicity likeable, ...
1
vote
0answers
122 views

Why are integers considered “little endian” in ChaCha20 function?

Why the ChaCha20 - IETF algorithm that generates 512 bit keystream per 32 bit counter (that gets incremented), considers "the input words" that form the internal state as little endian ? What will ...
2
votes
1answer
103 views

Using Poly1305 MAC key multiple times

I know that for Poly1305-ChaCha20 reusing the key does reveal information about the plaintext. How it is for the Poly1305 MAC algorithm? Revealing information about the plaintext is not a problem at ...
2
votes
1answer
71 views

Can poly1305 be used as an error-correction code?

Given a message $m$ of size $n$, a key $k$, and a message authentication code $mac = poly1305(m, k)$ what is the minimum amount of bitflips on the message that can be corrected (or at least detected) ...
1
vote
1answer
95 views

Poly1305 Key for MAC generation

I just went through https://tools.ietf.org/html/rfc7539#section-2.6 (sections 2.5 and 2.6). There it is described how to generate one-time Poly1305 keys using the ChaCha20 block function (for this a ...
2
votes
1answer
79 views

Can we get the msg when we know tag and key in Poly1305

Assume $tag[i]=\operatorname{MAC}(key[i],msg)$ Now we know: $tag[0],tag[1],\ldots,tag[n]$ $key[0],key[1],\ldots,key[n]$ Can we get the $msg$ from this? Or can we get the $tag$ of this $msg$ using ...
1
vote
1answer
144 views

Is it OK to just hash a symmetric key to derive an authentication key?

I'm using xsalsa20poly1305 for encryption in my program from libsodium. The recommended size for chunks is 4 kB. In that case, poly1305 will have authentication only for the the individual 4k chunks. ...
3
votes
2answers
422 views

Why not use chacha derivatives (BLAKE, rumba) to make an [H]MAC for use with chacha? Why use poly1305?

Why not use chacha derivatives (BLAKE, rumba) to make an [H]MAC for use with chacha? Why use poly1305? This question is especially interesting considering... "The security of Poly1305[...] is very ...
5
votes
2answers
190 views

Append data to authenticated ciphertext encrypted using a stream cipher

Say we have xSalsa20 authenticated using Poly1305. If $ X $ is the ciphertext, $N$ is the nonce value, and $H$ is the authentication tag such that the final ciphertext is $ N || X || H $, then given ...
3
votes
3answers
880 views

Largest message size for XChaCha20-Poly1305

libsodium documentation says that XChaCha20-Poly1305 can encrypt a message of arbitrary size. However, the only specification available (still a draft) explains that under the hood the IETF version ...
1
vote
1answer
61 views

How can I get select messages ciphers for salsa20poly1305 for unit tests?

In order to avoid memory errors, I always write safe C++ wrappers with strong type-safety for any C encryption library I use. To test my wrapper of ...
0
votes
2answers
112 views

How can I follow the validation and verification recommendations of the NaCl (sodium) secretbox library?

I was advised to use crypto_secretbox_xsalsa20poly1305 due to its simplicity and because it's safe against timing attacks. I'm reading the secretbox tutorial, and ...
1
vote
1answer
353 views

How does the squeeze function in the NaCl Poly1305 implementation work?

The NaCl ref implementation of the Poly1305 algorithm uses the following reduction function (which is called squeeze()): ...
2
votes
1answer
235 views

Does Java SunJCE Provider use AES for encrypting nonce in Poly1305?

RFC 8439 states: AES is used there for encrypting the nonce, so as to get a unique (and secret) 128-bit string, but as the paper states, "There is nothing special about AES here. One can replace ...
6
votes
1answer
720 views

Does ChaCha20-Poly1305 need random nonce?

RFC 7539 says: A 96-bit nonce -- different for each invocation with the same key It doesn't explicitly say whether it has to be random or not. If we use an ever incrementing counter. Would that be ...
3
votes
2answers
1k views

Understanding ChaCha20-Poly1305 AEAD

In the AEAD scheme described in https://tools.ietf.org/html/rfc7539#section-2.8.1, the aad and cyphertext are padded to be a multiple of 16 bytes in length. Why is this necessary? Does it provide any ...
3
votes
1answer
307 views

Does chacha20-poly1305 require new key for every encryption process?

As I know chacha20-poly1305 is stream cipher. Does that mean for every encryption process require a new key?
6
votes
1answer
244 views

Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh

OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS. The TLS version The openSSH version (and here) The openSSH version uses two ...
1
vote
1answer
385 views

Why is Poly1305, which is based on AES, faster than AES?

The web pages of BearSSL have the following performance numbers: Poly1305 1730.92 MB/s, amd64, ctmulq AES-128 CTR 92.38 MB/s, amd64, ct64 It seems that constant-time Poly1305 is over an order of ...
6
votes
1answer
692 views

Would it be safe to use the message hash as the IV in ChaCha?

This seemed like an option if the hash is unpredictable. It could be the hash of the message or the hash of the message + some common secret (apart from the key). The only circumstance in which the ...
0
votes
1answer
166 views

Sending the nonce in ChachaPoly1305 with the ciphertext

I am trying to implement a ChachaPoly1305 encryption with authentication scheme over a network. I am using a counter to derive the nonce as suggested by the rfc. Is it secure to send the nonce over ...
2
votes
0answers
54 views

Rationale behind IETF-ChaChaPoly's padding during MAC computation [duplicate]

RFC 7539 (Section 2.8) specifies a ChaCha20/Poly1305 based AEAD cipher scheme; pseudocode: ...
2
votes
1answer
157 views

Should I include the ciphertext length in an AAD when using Chacha20+Poly1205 AEAD?

I want to construct a time-limited authorization token using ChaCha20 and Poly1305 as defined by RFC7539. I chose the following simple layout: ...
1
vote
1answer
2k views

Which algorithm has better performance (HMAC, UMAC, and Poly1305)?

I want to implement a protocol which requires Integrity and Authentication for its messages. I found a lot of algorithms such as HMAC, UMAC, and Poly1305 which provide Integrity and Authentication. So ...
0
votes
0answers
96 views

How does Poly1305 use $2^{130}-5$?

How is the number $2^{130}-5$ used in Poly1305? It operates on blocks that are 128 bits long, but the number has 130 bits. I don't understand how it is used. This comment makes me think it uses ...
3
votes
2answers
159 views

Winternitz-OTS+ with Poly1305

Would it be safe to implement Winternitz OTS+ using Poly1305 as a parameterized MAC? It's very fast and apparently very secure but with the caveat that keys cannot be used more than once, which is ...
1
vote
1answer
249 views

Is streaming API to ChaCha20-Poly1305 possible or recommended against?

None of the implementations of ChaCha20-Poly1305 AEAD scheme I've seen so far provide a streaming API. Instead, ChaCha20-Poly1305 is presented as an inseparable combination, closely adhering to the ...
0
votes
1answer
99 views

Does this ECIES scheme make MAC redundant?

I've implemented ECIES (see the below pseudo-Python). ...
5
votes
3answers
2k views

ChaCha20-Poly1305 test vectors

I was trying to use OpenSSL 1.1 (via Ruby) to validate the ChaCha20-Poly1305 test vector from this IETF draft: https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-04#section-7 The relevant ...
11
votes
3answers
1k views

Is Poly1305 an information-theoretically secure MAC?

I have heard some people say that the Poly1305 authenticator is a "nuclear" MAC i.e. it is information-theoretically secure. After reading the paper I see it is based on the Wegman-Carter MAC which is ...
0
votes
1answer
113 views

Token generation using Mac?

I'm writing a web service that gives a unique token per client connection. And the following are the desired properties. I'm assuming server's issued token db is lost and untrustable client presents ...
3
votes
1answer
369 views

What is meant by a 1.5 pass cipher?

In What is the advantage of AEAD ciphers? Maarten Bodewes used the term 1.5 pass cipher in his answer. What is the difference between a 1.5 pass cipher and a 2 pass cipher? And why is Poly1305 a 1.5 ...
1
vote
2answers
268 views

Are this recommendations from Colin Percival correct? [closed]

In this article: http://www.bsdcan.org/2010/schedule/attachments/135_crypto1hr.pdf He has said: AVOID: Poly1305. If your name is Daniel Bernstein, go ahead and use this Otherwise, you’re never ...
5
votes
1answer
1k views

Poly1305-AES vs AES-GCM

What are the advantages of Poly1305-AES over AES-GCM? Please note I am not talking about chacha20-Poly1305 that has been widely adopted, including by Google. But I would like to know pros and cons ...
7
votes
2answers
643 views

Is there an upper limit to plaintext size in XSalsa20Poly1305?

While fiddling with the NaCl implementation in Go, specifically SecretBox, a general crypto question came up after reading the documentation. Quote: Package secretbox encrypts and authenticates ...
3
votes
2answers
284 views

Can universal hashing functions be (ab)used as stream ciphers?

These days, universal hashing functions like GHASH and Poly1305 are very trendy because of their simplicity and speed. Now during a discussion related to export restrictions, it came up that mainly ...
10
votes
2answers
2k views

Nonce encryption with Poly1305-Chacha20

I have seen that a couple of companies (like Google, Apple HomeKit) are adding "ChaCha20-Poly1305" as an encryption option. Poly1305 requires algorithm to encrypt the nonce. The Poly1305-AES ...
4
votes
1answer
662 views

Advantages of HS1-SIV over ChaCha20-Poly1305-SIV?

What advantages does HS1-SIV have over ChaCha20-Poly1305-SIV? I know that both use the ChaCha stream cipher, but I am trying to understand why HS1-Hash is a better MAC. Edit: To hide the Poly1305 ...
2
votes
1answer
1k views

Is XSalsa20-Poly1305-SIV a reasonable choice for nonce-misuse-resistant authenticated encryption?

Consider XSalsa20-Poly1305-SIV. This is obtained by: computing a MAC $t_{secret}$ of the plaintext from the key and nonce, as in ChaCha20-Poly1305 except that the plaintext, not the ciphertext, is ...