Questions tagged [poly1305]
Poly1305-AES is a cryptographic message authentication code (MAC) written by Daniel J. Bernstein. It can be used to verify the data integrity and the authenticity of a message.
73
questions
1
vote
2
answers
109
views
Poly1305 variants with bigger output?
This is a rather simple question, but answers are nowhere to be found. Are there any variants of Poly-n hashing algorithms which provide bigger outputs (like 32 instead of 16 bytes)? Or, is there any ...
- 125
0
votes
1
answer
74
views
How to caculate the inverse of function $x^3$ in $\mathbb{F}_{2^n}$
How to caculate the inverse of function $x^3$ in $\mathbb{F}_{2^n}$?,
Any monomial $x^d$ is a permutation in the field $\mathbb{F}_{2^n}$ iff $gdc(d,2^{n}-1)=1$,why?
- 25
0
votes
0
answers
239
views
Nonces in chacha20poly1305 vs chacha20
I'm currently working on replacing the chacha20 encryption in my app with chacha20poly1305, but I'm running into a few questions that I can't seem to find clear answers to, mainly stemming from the ...
0
votes
2
answers
407
views
Is CMAC secure without IV and the same key? (authenticate only)
I am a bit unsure about CMAC and GMAC and maybe someone can help me.
As far as I know, CMAC does not use an IV [SP 800-38B ch. 6.2]. Is it then secure if I use the same key for different messages? ......
- 3
1
vote
0
answers
196
views
xChaCha20 Block Keys for Poly1305
So xChaCha20 has a nonce size large enough to safely use a random nonce with the same key. Poly1305 generally uses the first block of the cipher's output to generate its nonce. For xChaCha20 it would ...
- 123
0
votes
1
answer
2k
views
How to choose between AES256-GCM, XSalsa20Poly1305 and XChaCha20Poly1305?
In libsodium, there're 3 symmetric encryption(stream cipher) which are AES256-GCM(Hardware-accelerated), XSalsa20Poly1305 and XChaCha20Poly1305(uncertain which version of libsodium add support to ...
- 125
0
votes
1
answer
150
views
Security level of Poly1305 and GMAC
The Libsodium docs list the AEAD forgery limits for ChaCha20Poly1305 and AES-GCM which seems like a < 128-bit security level but says that it's not a practical concern. I've seen other people say ...
- 3
6
votes
2
answers
184
views
Does Poly1305 have weak keys like GCM/GHASH?
Some block cipher keys are weak when used with GCM; see this question. This happens when the multiplier $H$ decided by the key ends up in a small-order subgroup of $\mathbb{F}_{2^{128}}$.
Poly1305 ...
- 2,451
2
votes
1
answer
259
views
Poly1305 reuse of r
Poly1305 uses $r, r^2, r^3$ and $r^4$. I understand this if $r$ is a generator of the finite field. But since $r$ can be any random non-zero number, won't its exponents be non-uniform distributed? ...
- 135
1
vote
0
answers
73
views
Impact of partitioning oracle attacks on file encryption?
I've just learned about partitioning oracle attacks recently, and I would like to clarify some things that are a little foggy to me right now.
According to this thread,
The aim is the recovery of a ...
- 421
1
vote
0
answers
224
views
Implement deterministic authenticated encryption using libsodium
Note: this is my first question on stack exchange, let me know if you miss some details to answer and I will edit the question accordingly
Context
I'm willing to create a git encryption tool (...
- 11
1
vote
2
answers
180
views
Is nonce-less Encrypt-then-HMAC as secure as poly1305
While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
- 77
1
vote
0
answers
23
views
Is Poly1305 enough for cascading ciphers? [duplicate]
ChaCha20 along with Poly1305 provides confidentiality and integrity. Now suppose I cascade AES on top of ChaCha20. Is it safe to assume that the Poly1305 MAC is still secure, even if I cascade ...
- 421
2
votes
2
answers
340
views
Can I use ChaCha20-Poly1305 as my KDF?
I have two devices that use a PSK. One is embedded and extremely resource confined. I'm already using ChaCha20-Poly1305 so it would be "free" to reuse this. There is no transport encryption ...
1
vote
1
answer
249
views
XSalsa20 + Poly1305 authentication wtihout tag
Do I understand correctly that XSalsa20 + Poly1305 provides authentication without a tag? If so, then how does that work?
I came to that conclusion by reading http://nacl.cr.yp.to/secretbox.html, &...
- 105
2
votes
2
answers
161
views
Which AES mode when using Poly1305-AES
I am reading DJ Bernstein's paper on the Poly1305-AES mac (https://cr.yp.to/mac/poly1305-20050329.pdf). I understand that AES is needed to provide the array s. In its paper on page 5 we can read:
...
- 123
2
votes
1
answer
474
views
How to increase Poly1305 performance?
I was analysing the Chacha20 algorithm and the Poly1305 MAC generation from RFC 7539.
It seems that the Chacha20 is quite faster compared to AES on CPUs without hardware support like AES-NI.
But ...
8
votes
3
answers
3k
views
What should the nonce value be for client-side encryption?
I am using the following chacha20poly1305 Rust library to encrypt some data in a desktop application. The user provides the key, which never leaves their device, to locally encrypt some data, and then ...
- 81
2
votes
2
answers
564
views
Forgery attack on Poly1305 when the key and nonce reused
Introduction: I've tried to find how reusing one-time key compromises itself but only found information that it breaks the encryption entirely, it is written everywhere. But since no methods to reuse ...
- 21
0
votes
0
answers
395
views
Secretbox- algorithm Poly1305 and cipher Xsalsa20
I use Rclone, which uses Secretbox to authenticate and encrypt data. Secretbox uses the Poly1305 authentication algorithm and the Xsalsa20 symmetric flow cipher. This whole process takes some time (...
2
votes
1
answer
906
views
Why is it secure to reuse key and nonce in ChaCha20-Poly1305 AEAD construction?
While looking at the ChaCha20 and Poly1305 AEAD construction as defined by RFC 8439, more precisely its use of the key and the nonce, I came up with the questions below. Maybe someone with some in-...
user80435
12
votes
3
answers
3k
views
What happened to Poly1305AES? Is it obsolete?
I've been told that Poly1305AES is a great choice of MAC for constrained (embedded) environments. I'd checked out DJB's writing on it briefly, and have to say that I found its simplicity likeable, ...
- 349
3
votes
0
answers
306
views
Why are integers considered "little endian" in ChaCha20 function?
Why the ChaCha20 - IETF algorithm that generates 512 bit keystream per 32 bit counter (that gets incremented), considers "the input words" that form the internal state as little endian ? ...
- 988
2
votes
1
answer
202
views
Using Poly1305 MAC key multiple times
I know that for Poly1305-ChaCha20 reusing the key does reveal information about the plaintext. How it is for the Poly1305 MAC algorithm? Revealing information about the plaintext is not a problem at ...
user35869
2
votes
1
answer
89
views
Can poly1305 be used as an error-correction code?
Given a message $m$ of size $n$, a key $k$, and a message authentication code $mac = poly1305(m, k)$ what is the minimum amount of bitflips on the message that can be corrected (or at least detected) ...
- 113
1
vote
1
answer
379
views
Poly1305 Key for MAC generation
I just went through https://www.rfc-editor.org/rfc/rfc7539#section-2.6 (sections 2.5 and 2.6). There it is described how to generate one-time Poly1305 keys using the ChaCha20 block function (for this ...
user35869
2
votes
1
answer
83
views
Can we get the msg when we know tag and key in Poly1305
Assume $tag[i]=\operatorname{MAC}(key[i],msg)$
Now we know:
$tag[0],tag[1],\ldots,tag[n]$
$key[0],key[1],\ldots,key[n]$
Can we get the $msg$ from this?
Or can we get the $tag$ of this $msg$ using ...
- 71
1
vote
1
answer
216
views
Is it OK to just hash a symmetric key to derive an authentication key?
I'm using xsalsa20poly1305 for encryption in my program from libsodium. The recommended size for chunks is 4 kB. In that case, poly1305 will have authentication only for the the individual 4k chunks. ...
4
votes
2
answers
1k
views
Why not use chacha derivatives (BLAKE, rumba) to make an [H]MAC for use with chacha? Why use poly1305?
Why not use chacha derivatives (BLAKE, rumba) to make an [H]MAC for use with chacha? Why use poly1305?
This question is especially interesting considering...
"The security of Poly1305[...] is very ...
- 344
5
votes
2
answers
419
views
Append data to authenticated ciphertext encrypted using a stream cipher
Say we have xSalsa20 authenticated using Poly1305. If $ X $ is the ciphertext, $N$ is the nonce value, and $H$ is the authentication tag such that the final ciphertext is $ N || X || H $, then given ...
- 1,522
4
votes
3
answers
2k
views
Largest message size for XChaCha20-Poly1305
libsodium documentation says that XChaCha20-Poly1305 can encrypt a message of arbitrary size.
However, the only specification available (still a draft) explains that under the hood the IETF version of ...
- 1,685
1
vote
1
answer
71
views
How can I get select messages ciphers for salsa20poly1305 for unit tests?
In order to avoid memory errors, I always write safe C++ wrappers with strong type-safety for any C encryption library I use.
To test my wrapper of ...
1
vote
2
answers
214
views
How can I follow the validation and verification recommendations of the NaCl (sodium) secretbox library?
I was advised to use crypto_secretbox_xsalsa20poly1305 due to its simplicity and because it's safe against timing attacks. I'm reading the secretbox tutorial, and ...
1
vote
1
answer
465
views
How does the squeeze function in the NaCl Poly1305 implementation work?
The NaCl ref implementation of the Poly1305 algorithm uses the following reduction function (which is called squeeze()):
...
- 113
2
votes
1
answer
277
views
Does Java SunJCE Provider use AES for encrypting nonce in Poly1305?
RFC 8439 states:
AES is used there for encrypting the nonce, so as to get a unique (and secret) 128-bit string, but as the paper states, "There is nothing special about AES here. One can replace ...
- 508
6
votes
1
answer
1k
views
Does ChaCha20-Poly1305 need random nonce?
RFC 7539 says:
A 96-bit nonce -- different for each invocation with the same key
It doesn't explicitly say whether it has to be random or not. If we use an ever incrementing counter. Would that be ...
- 508
3
votes
2
answers
2k
views
Understanding ChaCha20-Poly1305 AEAD
In the AEAD scheme described in https://www.rfc-editor.org/rfc/rfc7539#section-2.8.1, the aad and cyphertext are padded to be a multiple of 16 bytes in length. Why is this necessary? Does it provide ...
- 415
3
votes
1
answer
630
views
Does chacha20-poly1305 require new key for every encryption process?
As I know chacha20-poly1305 is stream cipher. Does that mean for every encryption process require a new key?
- 461
6
votes
1
answer
361
views
Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh
OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS.
The TLS version
The openSSH version (and here)
The openSSH version uses two ...
- 121
1
vote
1
answer
442
views
Why is Poly1305, which is based on AES, faster than AES?
The web pages of BearSSL have the following performance numbers:
Poly1305 1730.92 MB/s, amd64, ctmulq
AES-128 CTR 92.38 MB/s, amd64, ct64
It seems that constant-time Poly1305 is over an order of ...
- 1,247
6
votes
1
answer
1k
views
Would it be safe to use the message hash as the IV in ChaCha?
This seemed like an option if the hash is unpredictable.
It could be the hash of the message or the hash of the message + some common secret (apart from the key).
The only circumstance in which the ...
- 135
0
votes
1
answer
352
views
Sending the nonce in ChachaPoly1305 with the ciphertext
I am trying to implement a ChachaPoly1305 encryption with authentication scheme over a network. I am using a counter to derive the nonce as suggested by the rfc.
Is it secure to send the nonce over ...
- 277
2
votes
0
answers
54
views
Rationale behind IETF-ChaChaPoly's padding during MAC computation [duplicate]
RFC 7539 (Section 2.8) specifies a ChaCha20/Poly1305 based AEAD cipher scheme; pseudocode:
...
- 578
2
votes
1
answer
266
views
Should I include the ciphertext length in an AAD when using Chacha20+Poly1205 AEAD?
I want to construct a time-limited authorization token using ChaCha20 and Poly1305 as defined by RFC7539. I chose the following simple layout:
...
- 145
1
vote
1
answer
4k
views
Which algorithm has better performance (HMAC, UMAC, and Poly1305)?
I want to implement a protocol which requires Integrity and Authentication for its messages. I found a lot of algorithms such as HMAC, UMAC, and Poly1305 which provide Integrity and Authentication. So ...
- 461
0
votes
0
answers
139
views
How does Poly1305 use $2^{130}-5$?
How is the number $2^{130}-5$ used in Poly1305? It operates on blocks that are 128 bits long, but the number has 130 bits. I don't understand how it is used. This comment makes me think it uses ...
- 3,605
3
votes
2
answers
231
views
Winternitz-OTS+ with Poly1305
Would it be safe to implement Winternitz OTS+ using Poly1305 as a parameterized MAC? It's very fast and apparently very secure but with the caveat that keys cannot be used more than once, which is ...
- 896
1
vote
1
answer
469
views
Is streaming API to ChaCha20-Poly1305 possible or recommended against?
None of the implementations of ChaCha20-Poly1305 AEAD scheme I've seen so far provide a streaming API. Instead, ChaCha20-Poly1305 is presented as an inseparable combination, closely adhering to the ...
- 13
0
votes
1
answer
115
views
Does this ECIES scheme make MAC redundant?
I've implemented ECIES (see the below pseudo-Python).
...
- 825
5
votes
3
answers
3k
views
ChaCha20-Poly1305 test vectors
I was trying to use OpenSSL 1.1 (via Ruby) to validate the ChaCha20-Poly1305 test vector from this IETF draft: https://datatracker.ietf.org/doc/html/draft-agl-tls-chacha20poly1305-04#section-7
The ...
- 779