* Re: [bitcoin-dev] New BIP - v2 peer-to-peer message transport protocol
@ 2019-06-17 2:06 Elichai Turkel
2019-06-17 16:20 ` Jonas Schnelli
0 siblings, 1 reply; 3+ messages in thread
From: Elichai Turkel @ 2019-06-17 2:06 UTC (permalink / raw)
To: bitcoin-dev
[-- Attachment #1: Type: text/plain, Size: 581 bytes --]
Hi everyone,
About the nonce being 64bit. (rfc7539 changed it to 96bit, which djb later
calls xchacha)
You suggest that we use the "message sequence number" as the nonce for
Chacha20, Is this number randomly generate or is this a counter?
And could it be reseted without rekeying?
If it is randomly generated then 64bit isn't secure enough. And we should
either move to the chacha20 from RFC7539 which has 96bit nonce and 32bit
counter or increment it manually every time.
If it's simply a counter then 64bit nonce should be fine :)
Thanks,
Elichai.
--
PGP: 5607C93B5F86650C
[-- Attachment #2: Type: text/html, Size: 826 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [bitcoin-dev] New BIP - v2 peer-to-peer message transport protocol
2019-06-17 2:06 [bitcoin-dev] New BIP - v2 peer-to-peer message transport protocol Elichai Turkel
@ 2019-06-17 16:20 ` Jonas Schnelli
2019-06-17 17:13 ` Elichai Turkel
0 siblings, 1 reply; 3+ messages in thread
From: Jonas Schnelli @ 2019-06-17 16:20 UTC (permalink / raw)
To: Elichai Turkel, Bitcoin Protocol Discussion
[-- Attachment #1: Type: text/plain, Size: 1032 bytes --]
Hi Elichai
> About the nonce being 64bit. (rfc7539 changed it to 96bit, which djb later calls xchacha)
>
> You suggest that we use the "message sequence number" as the nonce for Chacha20, Is this number randomly generate or is this a counter?
> And could it be reseted without rekeying?
The in BIP324 (v2 message transport protocol) proposed AEAD, ChaCha20Poly1305@Bitcoin [1], uses a „message sequence number“. There is no such thing as random nonce described in the BIP (hence the term „sequence number“). The message sequence number starts with 0 and the max traffic before a rekey must occur is 1GB. A nonce/key reuse is conceptually impossible (of course implementations could screw up at this point).
Using XChaCha20 with the possibility of a random nonce could be done, but I don’t see a reason to use it in our case since the usage of a sequence number as nonce seems perfectly save.
[1] https://gist.github.com/jonasschnelli/c530ea8421b8d0e80c51486325587c52#chacha20-poly1305bitcoin-cipher-suite
[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [bitcoin-dev] New BIP - v2 peer-to-peer message transport protocol
2019-06-17 16:20 ` Jonas Schnelli
@ 2019-06-17 17:13 ` Elichai Turkel
0 siblings, 0 replies; 3+ messages in thread
From: Elichai Turkel @ 2019-06-17 17:13 UTC (permalink / raw)
To: Jonas Schnelli; +Cc: bitcoin-dev
[-- Attachment #1: Type: text/plain, Size: 1430 bytes --]
Thanks,
I just couldn't find where is the message sequence number comes from.
So if it's max 1GB and it's an incremental counter that cannot be reseted
without a rekeying than it's perfectly fine :).
Thanks for the answer!
On Mon, Jun 17, 2019 at 12:20 PM Jonas Schnelli <dev@jonasschnelli•ch>
wrote:
> Hi Elichai
>
> > About the nonce being 64bit. (rfc7539 changed it to 96bit, which djb
> later calls xchacha)
> >
> > You suggest that we use the "message sequence number" as the nonce for
> Chacha20, Is this number randomly generate or is this a counter?
> > And could it be reseted without rekeying?
>
> The in BIP324 (v2 message transport protocol) proposed AEAD,
> ChaCha20Poly1305@Bitcoin [1], uses a „message sequence number“. There is
> no such thing as random nonce described in the BIP (hence the term
> „sequence number“). The message sequence number starts with 0 and the max
> traffic before a rekey must occur is 1GB. A nonce/key reuse is conceptually
> impossible (of course implementations could screw up at this point).
>
> Using XChaCha20 with the possibility of a random nonce could be done, but
> I don’t see a reason to use it in our case since the usage of a sequence
> number as nonce seems perfectly save.
>
> [1]
> https://gist.github.com/jonasschnelli/c530ea8421b8d0e80c51486325587c52#chacha20-poly1305bitcoin-cipher-suite
>
--
PGP: 5607C93B5F86650C
[-- Attachment #2: Type: text/html, Size: 2040 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-06-17 17:13 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-17 2:06 [bitcoin-dev] New BIP - v2 peer-to-peer message transport protocol Elichai Turkel
2019-06-17 16:20 ` Jonas Schnelli
2019-06-17 17:13 ` Elichai Turkel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox