Jason A. Donenfeld <Jason@xxxxxxxxx> wrote: > > There is no such argument for > > memset(&chacha_state[12], 0, sizeof(u32) * 4); > > ChaCha has a counter and a nonce in those > > bits, so setting them to zero is a deviation. > > No. There's a new key each time. So the nonce begins at zero. And the > counter begins at zero as well at the beginning like usual. So it's > actually a rather boring by-the-books usage of chacha. No. ChaCha has a random nonce. > But the larger reason for rejecting your idea wholesale is that I'm > trying to enforce the property that input data goes through our hash > function (via mix_pool_bytes). Full stop! It's time that this > willy-nilly stuff ends where we're feeding in things right and left with > no actual design on which is ingesting what input and how it interacts. For input data, I agree completely. > So if you do think that a particular block of memory somewhere at some > point has some entropic value, then by all means call mix_pool_bytes or > add_device_randomness on it. But don't try to stuff it in where it > doesn't belong. This is not input data but more-or-less random state. I'm not trying to input it, just to leave it where it belongs rather than overwriting it with constants.
