MIME-Version: 1.0
References: <CALN7hCKheiE374S6wOMJSTufmuQFxa-d_0x_aJbEPT=KuDc0nw@mail.gmail.com>
	<76890B69-2004-41C4-B4E7-0C5D070142C3@jonasschnelli.ch>
In-Reply-To: <76890B69-2004-41C4-B4E7-0C5D070142C3@jonasschnelli.ch>
From: Elichai Turkel <elichai.turkel@gmail.com>
Date: Mon, 17 Jun 2019 13:13:05 -0400
Message-ID: <CALN7hCLP3JOpNbRhuaeEGU_L7Xop6A2QM9-Bv_m2TD8smqUHgQ@mail.gmail.com>
To: Jonas Schnelli <dev@jonasschnelli.ch>
Content-Type: multipart/alternative; boundary="000000000000a79b41058b881d9b"
Cc: bitcoin-dev@lists.linuxfoundation.org
Subject: Re: [bitcoin-dev] New BIP - v2 peer-to-peer message transport
	protocol
Precedence: list

--000000000000a79b41058b881d9b
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thanks,
I just couldn't find where is the message sequence number comes from.
So if it's max 1GB and it's an incremental counter that cannot be reseted
without a rekeying than it's perfectly fine :).

Thanks for the answer!

On Mon, Jun 17, 2019 at 12:20 PM Jonas Schnelli <dev@jonasschnelli.ch>
wrote:

> Hi Elichai
>
> > About the nonce being 64bit. (rfc7539 changed it to 96bit, which djb
> later calls xchacha)
> >
> > You suggest that we use the "message sequence number" as the nonce for
> Chacha20, Is this number randomly generate or is this a counter?
> > And could it be reseted without rekeying?
>
> The in BIP324 (v2 message transport protocol) proposed AEAD,
> ChaCha20Poly1305@Bitcoin [1], uses a =E2=80=9Emessage sequence number=E2=
=80=9C. There is
> no such thing as random nonce described in the BIP (hence the term
> =E2=80=9Esequence number=E2=80=9C). The message sequence number starts wi=
th 0 and the max
> traffic before a rekey must occur is 1GB. A nonce/key reuse is conceptual=
ly
> impossible (of course implementations could screw up at this point).
>
> Using XChaCha20 with the possibility of a random nonce could be done, but
> I don=E2=80=99t see a reason to use it in our case since the usage of a s=
equence
> number as nonce seems perfectly save.
>
> [1]
> https://gist.github.com/jonasschnelli/c530ea8421b8d0e80c51486325587c52#ch=
acha20-poly1305bitcoin-cipher-suite
>


--=20
PGP: 5607C93B5F86650C

--000000000000a79b41058b881d9b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">Thanks,<br>I just couldn&#39;t find where=
 is the message sequence number comes from.<br>So if it&#39;s max 1GB and i=
t&#39;s an incremental counter that cannot be reseted without a rekeying th=
an it&#39;s perfectly fine :).<br><br>Thanks for the answer!</div><br><div =
class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, Jun 17,=
 2019 at 12:20 PM Jonas Schnelli &lt;<a href=3D"mailto:dev@jonasschnelli.ch=
" target=3D"_blank">dev@jonasschnelli.ch</a>&gt; wrote:<br></div><blockquot=
e class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px s=
olid rgb(204,204,204);padding-left:1ex">Hi Elichai<br>
<br>
&gt; About the nonce being 64bit. (rfc7539 changed it to 96bit, which djb l=
ater calls xchacha)<br>
&gt; <br>
&gt; You suggest that we use the &quot;message sequence number&quot; as the=
 nonce for Chacha20, Is this number randomly generate or is this a counter?=
<br>
&gt; And could it be reseted without rekeying?<br>
<br>
The in BIP324 (v2 message transport protocol) proposed AEAD, ChaCha20Poly13=
05@Bitcoin [1], uses a =E2=80=9Emessage sequence number=E2=80=9C. There is =
no such thing as random nonce described in the BIP (hence the term =E2=80=
=9Esequence number=E2=80=9C). The message sequence number starts with 0 and=
 the max traffic before a rekey must occur is 1GB. A nonce/key reuse is con=
ceptually impossible (of course implementations could screw up at this poin=
t).<br>
<br>
Using XChaCha20 with the possibility of a random nonce could be done, but I=
 don=E2=80=99t see a reason to use it in our case since the usage of a sequ=
ence number as nonce seems perfectly save.<br>
<br>
[1] <a href=3D"https://gist.github.com/jonasschnelli/c530ea8421b8d0e80c5148=
6325587c52#chacha20-poly1305bitcoin-cipher-suite" rel=3D"noreferrer" target=
=3D"_blank">https://gist.github.com/jonasschnelli/c530ea8421b8d0e80c5148632=
5587c52#chacha20-poly1305bitcoin-cipher-suite</a><br>
</blockquote></div><br clear=3D"all"><div><br></div>-- <br><div dir=3D"ltr"=
 class=3D"m_2055938350173082337gmail_signature">PGP: 5607C93B5F86650C<br><b=
r></div></div>

--000000000000a79b41058b881d9b--