Subject: [saag] How to handle block overflow in ChaCha-TLS?

From: Jeffrey Walton <[email-masked]>
Date: Thu, 24 Jan 2019 05:09:45 -0500

Hi Everyone,

ChaCha-TLS from RFC 7539 uses one 32-bit word for a block counter.
Bernstein ChaCha uses two words and we do something like this:

    if (++state[12] == 0)
        state[13]++;

How do we handle the overflow in ChaCha-TLS? Do we throw an overflow
exception? Do we carry into the 13th word (increment the high word of
the nonce)? Do we wrap around (seems very bad)? Or something else?

I'd also be grateful if someone knows where the official
implementation of ChaCha-TLS is available to generate test cases. I'm
particularly interested in starting the cipher with state[12] =
0xffffffff and see how it handles overflow when processing a large
block.

Jeff

---

From: Yoav Nir <[email-masked]>
Date: Thu, 24 Jan 2019 20:00:34 +0200

> On 24 Jan 2019, at 12:09, Jeffrey Walton <[email-masked]> wrote:
> 
> Hi Everyone,
> 

Hi, Jeff.

ChaCha20-Poly1305 as described in RFC 7539 is intended for use in network protocols such as TLS, IPsec, and SSH. All of those have packets or records of reasonable length (65536 for IPsec, 16384 for TLS).

A block of ChaCha20 is 64 bytes, so a TLS record requires at most 256 blocks and an IPsec packet at most 1024.  Both of these numbers easily fit in a 32-bit block counter that is word 12.  In theory, the modified ChaCha20 can handle messages up to a million petabytes.

For each new packet or record, you advance the nonce, which is in words 13-15, allowing for up to 2^96 packets or records.

The change we made allowed for more messages, but shorter ones, because for the use of network protocols we figured that a limit of 2^38 bytes per message was fine, but a limit of 2^64 messages per key was not.  More details about using this algorithm for TLS are available in RFC 7905.

And there’s no “official” implementation. There is one in OpenSSL as well as in many other libraries. I generated the test vectors with a quick implementation that I wrote on this very laptop that I’m using to send this message, but it was tested by several other people with their own implementations prior to publication.

Hope this helps

Yoav

---

From: Jeffrey Walton <[email-masked]>
Date: Fri, 25 Jan 2019 22:51:46 -0500

> the nonce)? Do we wrap around (seems very bad)? Or something else?

The question was moved to the CFRG list at How to handle block counter
wrap in IETF's ChaCha algorithm?,
https://mailarchive.ietf.org/arch/msg/cfrg/gsOnTJzcbgG6OqD8Sc0GO5aR_tU.

Jeff