Questions tagged [poly1305]

Poly1305-AES is a cryptographic message authentication code (MAC) written by Daniel J. Bernstein. It can be used to verify the data integrity and the authenticity of a message.

Filter by
Sorted by
Tagged with
0
votes
1answer
114 views

How to choose between AES256-GCM, XSalsa20Poly1305 and XChaCha20Poly1305?

In libsodium, there're 3 symmetric encryption(stream cipher) which are AES256-GCM(Hardware-accelerated), XSalsa20Poly1305 and XChaCha20Poly1305(uncertain which version of libsodium add support to ...
0
votes
1answer
41 views

Security level of Poly1305 and GMAC

The Libsodium docs list the AEAD forgery limits for ChaCha20Poly1305 and AES-GCM which seems like a < 128-bit security level but says that it's not a practical concern. I've seen other people say ...
6
votes
2answers
123 views

Does Poly1305 have weak keys like GCM/GHASH?

Some block cipher keys are weak when used with GCM; see this question. This happens when the multiplier $H$ decided by the key ends up in a small-order subgroup of $\mathbb{F}_{2^{128}}$. Poly1305 ...
2
votes
1answer
188 views

Poly1305 reuse of r

Poly1305 uses $r, r^2, r^3$ and $r^4$. I understand this if $r$ is a generator of the finite field. But since $r$ can be any random non-zero number, won't its exponents be non-uniform distributed? ...
1
vote
0answers
42 views

Impact of partitioning oracle attacks on file encryption?

I've just learned about partitioning oracle attacks recently, and I would like to clarify some things that are a little foggy to me right now. According to this thread, The aim is the recovery of a ...
1
vote
0answers
71 views

Implement deterministic authenticated encryption using libsodium

Note: this is my first question on stack exchange, let me know if you miss some details to answer and I will edit the question accordingly Context I'm willing to create a git encryption tool (...
1
vote
2answers
76 views

Is nonce-less Encrypt-then-HMAC as secure as poly1305

While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
1
vote
0answers
21 views

Is Poly1305 enough for cascading ciphers? [duplicate]

ChaCha20 along with Poly1305 provides confidentiality and integrity. Now suppose I cascade AES on top of ChaCha20. Is it safe to assume that the Poly1305 MAC is still secure, even if I cascade ...
2
votes
2answers
166 views

Can I use ChaCha20-Poly1305 as my KDF?

I have two devices that use a PSK. One is embedded and extremely resource confined. I'm already using ChaCha20-Poly1305 so it would be "free" to reuse this. There is no transport encryption ...
1
vote
1answer
154 views

XSalsa20 + Poly1305 authentication wtihout tag

Do I understand correctly that XSalsa20 + Poly1305 provides authentication without a tag? If so, then how does that work? I came to that conclusion by reading http://nacl.cr.yp.to/secretbox.html, &...
2
votes
2answers
113 views

Which AES mode when using Poly1305-AES

I am reading DJ Bernstein's paper on the Poly1305-AES mac (https://cr.yp.to/mac/poly1305-20050329.pdf). I understand that AES is needed to provide the array s. In its paper on page 5 we can read: ...
1
vote
0answers
178 views

How to increase Poly1305 performance?

I was analysing the Chacha20 algorithm and the Poly1305 MAC generation from RFC 7539. It seems that the Chacha20 is quite faster compared to AES on CPUs without hardware support like AES-NI. But ...
7
votes
3answers
2k views

What should the nonce value be for client-side encryption?

I am using the following chacha20poly1305 Rust library to encrypt some data in a desktop application. The user provides the key, which never leaves their device, to locally encrypt some data, and then ...
2
votes
2answers
194 views

Forgery attack on Poly1305 when the key and nonce reused

Introduction: I've tried to find how reusing one-time key compromises itself but only found information that it breaks the encryption entirely, it is written everywhere. But since no methods to reuse ...
0
votes
0answers
169 views

Secretbox- algorithm Poly1305 and cipher Xsalsa20

I use Rclone, which uses Secretbox to authenticate and encrypt data. Secretbox uses the Poly1305 authentication algorithm and the Xsalsa20 symmetric flow cipher. This whole process takes some time (...
2
votes
1answer
372 views

Why is it secure to reuse key and nonce in ChaCha20-Poly1305 AEAD construction?

While looking at the ChaCha20 and Poly1305 AEAD construction as defined by RFC 8439, more precisely its use of the key and the nonce, I came up with the questions below. Maybe someone with some in-...
12
votes
3answers
3k views

What happened to Poly1305AES? Is it obsolete?

I've been told that Poly1305AES is a great choice of MAC for constrained (embedded) environments. I'd checked out DJB's writing on it briefly, and have to say that I found its simplicity likeable, ...
1
vote
0answers
156 views

Why are integers considered "little endian" in ChaCha20 function?

Why the ChaCha20 - IETF algorithm that generates 512 bit keystream per 32 bit counter (that gets incremented), considers "the input words" that form the internal state as little endian ? ...
2
votes
1answer
130 views

Using Poly1305 MAC key multiple times

I know that for Poly1305-ChaCha20 reusing the key does reveal information about the plaintext. How it is for the Poly1305 MAC algorithm? Revealing information about the plaintext is not a problem at ...
2
votes
1answer
76 views

Can poly1305 be used as an error-correction code?

Given a message $m$ of size $n$, a key $k$, and a message authentication code $mac = poly1305(m, k)$ what is the minimum amount of bitflips on the message that can be corrected (or at least detected) ...
1
vote
1answer
136 views

Poly1305 Key for MAC generation

I just went through https://www.rfc-editor.org/rfc/rfc7539#section-2.6 (sections 2.5 and 2.6). There it is described how to generate one-time Poly1305 keys using the ChaCha20 block function (for this ...
2
votes
1answer
82 views

Can we get the msg when we know tag and key in Poly1305

Assume $tag[i]=\operatorname{MAC}(key[i],msg)$ Now we know: $tag[0],tag[1],\ldots,tag[n]$ $key[0],key[1],\ldots,key[n]$ Can we get the $msg$ from this? Or can we get the $tag$ of this $msg$ using ...
1
vote
1answer
176 views

Is it OK to just hash a symmetric key to derive an authentication key?

I'm using xsalsa20poly1305 for encryption in my program from libsodium. The recommended size for chunks is 4 kB. In that case, poly1305 will have authentication only for the the individual 4k chunks. ...
3
votes
2answers
566 views

Why not use chacha derivatives (BLAKE, rumba) to make an [H]MAC for use with chacha? Why use poly1305?

Why not use chacha derivatives (BLAKE, rumba) to make an [H]MAC for use with chacha? Why use poly1305? This question is especially interesting considering... "The security of Poly1305[...] is very ...
5
votes
2answers
236 views

Append data to authenticated ciphertext encrypted using a stream cipher

Say we have xSalsa20 authenticated using Poly1305. If $ X $ is the ciphertext, $N$ is the nonce value, and $H$ is the authentication tag such that the final ciphertext is $ N || X || H $, then given ...
3
votes
3answers
1k views

Largest message size for XChaCha20-Poly1305

libsodium documentation says that XChaCha20-Poly1305 can encrypt a message of arbitrary size. However, the only specification available (still a draft) explains that under the hood the IETF version of ...
1
vote
1answer
63 views

How can I get select messages ciphers for salsa20poly1305 for unit tests?

In order to avoid memory errors, I always write safe C++ wrappers with strong type-safety for any C encryption library I use. To test my wrapper of ...
1
vote
2answers
145 views

How can I follow the validation and verification recommendations of the NaCl (sodium) secretbox library?

I was advised to use crypto_secretbox_xsalsa20poly1305 due to its simplicity and because it's safe against timing attacks. I'm reading the secretbox tutorial, and ...
1
vote
1answer
365 views

How does the squeeze function in the NaCl Poly1305 implementation work?

The NaCl ref implementation of the Poly1305 algorithm uses the following reduction function (which is called squeeze()): ...
2
votes
1answer
248 views

Does Java SunJCE Provider use AES for encrypting nonce in Poly1305?

RFC 8439 states: AES is used there for encrypting the nonce, so as to get a unique (and secret) 128-bit string, but as the paper states, "There is nothing special about AES here. One can replace ...
6
votes
1answer
791 views

Does ChaCha20-Poly1305 need random nonce?

RFC 7539 says: A 96-bit nonce -- different for each invocation with the same key It doesn't explicitly say whether it has to be random or not. If we use an ever incrementing counter. Would that be ...
3
votes
2answers
1k views

Understanding ChaCha20-Poly1305 AEAD

In the AEAD scheme described in https://www.rfc-editor.org/rfc/rfc7539#section-2.8.1, the aad and cyphertext are padded to be a multiple of 16 bytes in length. Why is this necessary? Does it provide ...
3
votes
1answer
356 views

Does chacha20-poly1305 require new key for every encryption process?

As I know chacha20-poly1305 is stream cipher. Does that mean for every encryption process require a new key?
6
votes
1answer
256 views

Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh

OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS. The TLS version The openSSH version (and here) The openSSH version uses two ...
1
vote
1answer
401 views

Why is Poly1305, which is based on AES, faster than AES?

The web pages of BearSSL have the following performance numbers: Poly1305 1730.92 MB/s, amd64, ctmulq AES-128 CTR 92.38 MB/s, amd64, ct64 It seems that constant-time Poly1305 is over an order of ...
6
votes
1answer
804 views

Would it be safe to use the message hash as the IV in ChaCha?

This seemed like an option if the hash is unpredictable. It could be the hash of the message or the hash of the message + some common secret (apart from the key). The only circumstance in which the ...
0
votes
1answer
186 views

Sending the nonce in ChachaPoly1305 with the ciphertext

I am trying to implement a ChachaPoly1305 encryption with authentication scheme over a network. I am using a counter to derive the nonce as suggested by the rfc. Is it secure to send the nonce over ...
2
votes
0answers
54 views

Rationale behind IETF-ChaChaPoly's padding during MAC computation [duplicate]

RFC 7539 (Section 2.8) specifies a ChaCha20/Poly1305 based AEAD cipher scheme; pseudocode: ...
2
votes
1answer
182 views

Should I include the ciphertext length in an AAD when using Chacha20+Poly1205 AEAD?

I want to construct a time-limited authorization token using ChaCha20 and Poly1305 as defined by RFC7539. I chose the following simple layout: ...
1
vote
1answer
3k views

Which algorithm has better performance (HMAC, UMAC, and Poly1305)?

I want to implement a protocol which requires Integrity and Authentication for its messages. I found a lot of algorithms such as HMAC, UMAC, and Poly1305 which provide Integrity and Authentication. So ...
0
votes
0answers
99 views

How does Poly1305 use $2^{130}-5$?

How is the number $2^{130}-5$ used in Poly1305? It operates on blocks that are 128 bits long, but the number has 130 bits. I don't understand how it is used. This comment makes me think it uses ...
3
votes
2answers
184 views

Winternitz-OTS+ with Poly1305

Would it be safe to implement Winternitz OTS+ using Poly1305 as a parameterized MAC? It's very fast and apparently very secure but with the caveat that keys cannot be used more than once, which is ...
1
vote
1answer
273 views

Is streaming API to ChaCha20-Poly1305 possible or recommended against?

None of the implementations of ChaCha20-Poly1305 AEAD scheme I've seen so far provide a streaming API. Instead, ChaCha20-Poly1305 is presented as an inseparable combination, closely adhering to the ...
0
votes
1answer
102 views

Does this ECIES scheme make MAC redundant?

I've implemented ECIES (see the below pseudo-Python). ...
5
votes
3answers
2k views

ChaCha20-Poly1305 test vectors

I was trying to use OpenSSL 1.1 (via Ruby) to validate the ChaCha20-Poly1305 test vector from this IETF draft: https://datatracker.ietf.org/doc/html/draft-agl-tls-chacha20poly1305-04#section-7 The ...
11
votes
3answers
2k views

Is Poly1305 an information-theoretically secure MAC?

I have heard some people say that the Poly1305 authenticator is a "nuclear" MAC i.e. it is information-theoretically secure. After reading the paper I see it is based on the Wegman-Carter MAC which is ...
0
votes
1answer
117 views

Token generation using Mac?

I'm writing a web service that gives a unique token per client connection. And the following are the desired properties. I'm assuming server's issued token db is lost and untrustable client presents ...
3
votes
1answer
382 views

What is meant by a 1.5 pass cipher?

In What is the advantage of AEAD ciphers? Maarten Bodewes used the term 1.5 pass cipher in his answer. What is the difference between a 1.5 pass cipher and a 2 pass cipher? And why is Poly1305 a 1.5 ...
1
vote
2answers
286 views

Are this recommendations from Colin Percival correct? [closed]

In this article: http://www.bsdcan.org/2010/schedule/attachments/135_crypto1hr.pdf He has said: AVOID: Poly1305. If your name is Daniel Bernstein, go ahead and use this Otherwise, you’re never ...
7
votes
1answer
2k views

Poly1305-AES vs AES-GCM

What are the advantages of Poly1305-AES over AES-GCM? Please note I am not talking about chacha20-Poly1305 that has been widely adopted, including by Google. But I would like to know pros and cons ...