3 ms·
The thing is, OpenSSL already supports longer-than-default 12-byte nonces for GCM and OCB, and as of a day ago used to support the same for ChaCha20-Poly1305. G
by jorangreef 8y ago
The thing is, OpenSSL already supports longer-than-default 12-byte nonces for GCM and OCB, and as of a day ago used to support the same for ChaCha20-Poly1305. GCM and OCB don't fail however. That makes this less of an application bug, and more of a hole in the OpenSSL implementation.
In the first place, support for longer-than-default nonces should never have been introduced by OpenSSL. But far worse, all along there was simply no implementation behind it for ChaCha20-Poly1305. The first 4 bytes were simply discarded.
- blattimwind 8y agoThe difference is that for GCM and OCB nonces with lengths different from 96 bits are defined (albeit not recommended), whereas Chacha20-Poly1305 doesn't support that in the first place. The bug isn't OpenSSL throwing bytes away, the bug is OpenSSL acting as-if anything other than 96 bit nonces are acceptable.