-
-
Notifications
You must be signed in to change notification settings - Fork 473
Added test vectors for StdRng, verified using rand_chacha. #1654
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
dhardy
wants to merge
1
commit into
master
Choose a base branch
from
push-nqommrnzsqkq
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So these are not the test vectors from the paper... thus this is more a stability test than replication.
Do we have a source of ChaCha12 test vectors we can replace these with?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Potentially this: https://datatracker.ietf.org/doc/html/draft-strombergson-chacha-test-vectors-01
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The ChaCha implemented by rand_chacha and chacha20 is the ChaCha variant from "chacha20-poly1305", defined by that IETF paper for traffic encryption (e.g. TLS). This is not the original ChaCha, but has been modified to reduce the counter from the original 64 bits to 32, to make room for a larger nonce. That was probably OK back then, but now that bandwidths have increased, you may have to rekey frequenctly to avoid counter wraparound (which would completely break the crypto).
The paper for chacha20-poly1305 only has test vectors for ChaCha20 so the expected values have to be replaced, as the comment says. As you correctly point out, this means that the tests only verify stability and are not proof in any way that the algorithm is correct. I am not aware of any official test vectors for a "chacha12-poly1305". There is probably no such algorithm, so there probably are none.
On the other hand, most ChaCha implementations are probably parameterized with regards to number of rounds, so if both these independent(?) implementations (rand_chacha and chacha20) are verified with official test vectors for chacha20-poly1305 and they both pass these tests with these custom expected values for "chacha12-poly1305", then it is a little difficult to imagine how anything can be broken.
The paper with test vectors that you link to is for the original ChaCha algorithm with 64 bit counter. These are the test vectors I used for the ChaCha I implemented for smallrand, as I preferred the original 64 bit counter. They will fail if you use them for the a ChaCha from chacha20-poly1305 like rand_chacha or chacha20.
Speaking of nonces, I think it would improve security a bit if rand initialized the nonce by default. It's good practice to always initialize nonces.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hmm. Perhaps some of the Strombergson test vectors could be adapted to work if you pad out the nonce, depending on the endianness of the counter.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No, I'm in the wrong here. rand_chacha uses the 64 bit counter, while chacha20 does not. So the Strombergson test vectors are better here, and the current test vectors are a little insufficient in that they do not reveal the smaller counter.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Which, as it happens, we don't want for an RNG: we don't need to rekey that frequently, but we do need an RNG that can run all day (or all year) without cycling (because we can't predict how it will be used).
This isn't a concern for here though and RustCrypto/stream-ciphers#399 is already open.
So I think the
chacha20
migration is blocked for now unfortunately.