On Thu, Sep 21, 2023 at 08:10:30PM -0700, Eric Biggers wrote: > > Well, IV is *initialization vector*: a value that the algorithm uses as input. > It shouldn't be overloaded to represent some internal intermediate state. We > already made this mistake with the iv vs. iv_out thing, which only ever got > implemented by CBC and CTR, and people repeatedly get confused by. So we know > it technically works for those two algorithms, but not anything else. > > With ChaCha, for example, it makes more sense to use 16-word state matrix as the > intermediate state instead of the 4-word "IV". (See chacha_crypt().) > Especially for XChaCha, so that the HChaCha step doesn't need to be repeated. Fair enough, but what's the point of keeping the internal state across two lskcipher calls? The whole point of lskcipher is that the input is linear and can be processed in one go. With shash we must keep the internal state because the API operates on the update/final model so we need multiple suboperations to finish each hashing operation. With ciphers we haven't traditionally done it that way. Are you thinking of extending lskcipher so that it is more like hashing, with an explicit finalisation step? Thanks, -- Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
