On Fri, 28 Nov 2014 17:57:26 +0000
Michael Rogers <michael@xxxxxxxxxxxxxxxx> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> On 28/11/14 15:50, Yawning Angel wrote:
> > A one time poly1305 key is calculated for each box, based on 32
> > bytes of zeroes encrypted with a one time Salsa20 key/counter
> > derived from the nonce and the box key. You can view the use of
> > Salsa20 there as an arbitrary keyed hash function (in the case of
> > the original paper, AES was used).
> >
> > Hope that clarifies things somewhat,
>
> Thanks - this is similar to the argument I came up with. I called my
> argument hand-wavy because it relies on HSalsa20 and Salsa20 being
> PRFs, and I don't know how big an assumption that is.
For what it's worth "7 Nonce and stream" both support using a counter
here as the nonce, and refers to 'The standard ("PRF") security
conjecture for Salsa20". IIRC the security proof for the extended
nonce variants also hinges on the underlying algorithms being PRFs as
well, so it's something I'm comfortable in assuming.
http://cr.yp.to/highspeed/naclcrypto-20090310.pdf
Regards,
--
Yawning Angel
Attachment:
pgpLthNdHlfGI.pgp
Description: OpenPGP digital signature
_______________________________________________ tor-dev mailing list tor-dev@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev