On Tue, Sep 04, 2018 at 14:49:29 CEST, Christoph Anton Mitterer wrote: > On Mon, 2018-09-03 at 09:48 +0200, Milan Broz wrote: > > sorry for long delay, I was most of the time offline. > Thanks, and no worries :-) > > > > On 19/08/18 19:27, Christoph Anton Mitterer wrote: > > > - ChaCha20 seems to have all 128 bit IV... but is this correct? > > > I've > > > modpobed chacha20poly1305 ... but at least ther's no reference to > > > poly1305 in /proc/crypto > > > > No, we use RFC7539 wrapper for Chacha20-poly1305 and here the nonce > > is > > only 96bit. > > > > So the same probability of collision as in GCM, just a nonce > > collision > > does not cause such fatal failure as in GCM. > > Are there any plans to provide ChaCha20/Poly1305 with larger nonces in > the future? I don't think that is a concern. 96bit, even if randomly chosen, is unlikely to collide in the remaining lifetime of this star-system. Regards, Arno -- Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@xxxxxxxxxxx GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- A good decision is based on knowledge and not on numbers. -- Plato If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx https://www.saout.de/mailman/listinfo/dm-crypt
