MIME-Version: 1.0
In-Reply-To: <f1809076-4875-1c34-b321-681ccf1b2071@palant.de>
References: <2d0a8c01-9f58-1ee7-7e20-53fe65d96718@palant.de>
 <CAJQvAueazfvt9g2nPsqyuzecJXU0BRVs7hyZoqFBdG3bCmxO+w@mail.gmail.com>
 <f1809076-4875-1c34-b321-681ccf1b2071@palant.de>
From: Henri Sivonen <hsivonen@hsivonen.fi>
Date: Tue, 4 Jul 2017 09:41:32 +0300
Message-ID: <CAJQvAuePi1ULTxJJKmwwwSNRn-dRuK0cfjWMqm2nBQDqYxeDzw@mail.gmail.com>
To: Wladimir Palant <gtiobnam@palant.de>
Content-Type: text/plain; charset="UTF-8"
Cc: obnam-dev@obnam.org
Subject: Re: [rfc] Passphrase-based encryption
Precedence: list
Sender: obnam-dev-bounces@obnam.org
Errors-To: obnam-dev-bounces@obnam.org

On Mon, Jul 3, 2017 at 10:16 PM, Wladimir Palant <gtiobnam@palant.de> wrote:
> On 03.07.2017 20:29, Henri Sivonen wrote:
>> Probably more important that letting users tweak the key size is to
>> make sure that the AEAD construction is good and suitable for use with
>> a randomly-generated nonce for the amount of data one would expect to
>> encrypt using Obnam. I don't know if CFB fits this, but
>> XSalsa20+Poly1305 or XChaCha20+Poly1305 should (the non-X variants of
>> Salsa20 and ChaCha20 *don't*).
>
>
> CFB uses initialization vectors (randomly generated for each file in my
> case) which I think serve a similar purpose. But I'm not really familiar
> with either Salsa20 or ChaCha20 so I would be grateful if you could expand.
> What kind of issues is this about?

If the nonce has too few bits, the probability of nonce reuse is more
than negligible for randomly-generated nonces. The X in XSalsa20 and
XChaCha20 stands for eXtended nonce: A nonce that's long enough that
the probability of nonce reuse with randomly-generated nonces is
considered negligible. XSalsa20 uses a 192-bit nonce. Salsa20 uses a
64-bit nonce.

A 192-bit nonce is considered long enough in order for it to be OK to
generate the nonce simply by pulling the bits out of a random number
generator while a 64-bit nonce is too short for that to be OK. I now
fail to find a good paper that would explain why 192 bits is
considered enough and how bad 128-bit nonces are, but it is a matter
of probability. (I can't recall how the probability threshold for
"negligible" is chosen.)

> Are you implying that these algorithms
> would be better performance-wise?

At least ChaCha20 outperforms AES in the absence of hardware support
for AES (such as Intel AES-NI).
https://www.imperialviolet.org/2013/10/07/chacha20.html

-- 
Henri Sivonen
hsivonen@hsivonen.fi
https://hsivonen.fi/

_______________________________________________
obnam-dev mailing list
obnam-dev@obnam.org
http://listmaster.pepperfish.net/cgi-bin/mailman/listinfo/obnam-dev-obnam.org