4 ms·
It's too bad IETF didn't at least specify a standard way to use XChacha20/XSalsa20 with Poly1305 for AEAD. As it is you have to rely on all implementations to:
by unscaled 9y ago
It's too bad IETF didn't at least specify a standard way to use XChacha20/XSalsa20 with Poly1305 for AEAD. As it is you have to rely on all implementations to:
1. Split the nonce and counter the same way.
libsodium uses a 64-bit nonce, 32-bit counter and 32-bit wasted zero bytes for IETF compatibility ;). (You could also say it's a 64-bit counter that never counts past 2^32-1).
2. Feed the AEAD into Poly1305 in the same way.
IIRC libsodium hashes everything in this order:
AEAD padded with zeros, so length will be a multiple of 16
message padded with zeros in the same way
AEAD length
message length
This is the same as the scheme IETF defined for ChaCha20Poly1305, but it's not defined in any standard XChacha20Poly1305, so nobody can guarantee that the library you're using will do the same (if it supports XChaCha20 at all).