đź“… Original date posted:2019-06-17
đź“ť Original message:Thanks,
I just couldn't find where is the message sequence number comes from.
So if it's max 1GB and it's an incremental counter that cannot be reseted
without a rekeying than it's perfectly fine :).
Thanks for the answer!
On Mon, Jun 17, 2019 at 12:20 PM Jonas Schnelli <dev at jonasschnelli.ch>
wrote:
> Hi Elichai
>
> > About the nonce being 64bit. (rfc7539 changed it to 96bit, which djb
> later calls xchacha)
> >
> > You suggest that we use the "message sequence number" as the nonce for
> Chacha20, Is this number randomly generate or is this a counter?
> > And could it be reseted without rekeying?
>
> The in BIP324 (v2 message transport protocol) proposed AEAD,
> ChaCha20Poly1305 at Bitcoin [1], uses a „message sequence number“. There is
> no such thing as random nonce described in the BIP (hence the term
> „sequence number“). The message sequence number starts with 0 and the max
> traffic before a rekey must occur is 1GB. A nonce/key reuse is conceptually
> impossible (of course implementations could screw up at this point).
>
> Using XChaCha20 with the possibility of a random nonce could be done, but
> I don’t see a reason to use it in our case since the usage of a sequence
> number as nonce seems perfectly save.
>
> [1]
> https://gist.github.com/jonasschnelli/c530ea8421b8d0e80c51486325587c52#chacha20-poly1305bitcoin-cipher-suite
>
--
PGP: 5607C93B5F86650C
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20190617/d7cf1656/attachment-0001.html>;
Elichai Turkel [ARCHIVE] /
npub1yh…langm
2023-06-07 18:18:43
in reply to nevent1q…jynv
Author Public Key
npub1yhah9d8m47mkm00dy2ngukyw6gqxfemvvdj7nyx6hh2pzwhzf35s0langmSeen on
wss://relay.nostr.bandPublished at
2023-06-07 18:18:43Event JSON
{
"id": "35d6ccfdf78b95f824baf024981a56c79296d230088a079db63b48abd0a00b2b",
"pubkey": "25fb72b4fbafb76dbded22a68e588ed20064e76c6365e990dabdd4113ae24c69",
"created_at": 1686161923,
"kind": 1,
"tags": [
[
"e",
"eaa0918106e5f41d1211c7666eb82fba89fb6f4148efeabd48dd6d517c5cf609",
"",
"root"
],
[
"e",
"54a2032aefc3f7ac75d10db50a6199941e499ec7d339fc0f4c27b31e0549d711",
"",
"reply"
],
[
"p",
"9a463e0fab8963b013698c15a0f2449d19c97f3b88458e5874095b5006df9a0c"
]
],
"content": "📅 Original date posted:2019-06-17\n📝 Original message:Thanks,\nI just couldn't find where is the message sequence number comes from.\nSo if it's max 1GB and it's an incremental counter that cannot be reseted\nwithout a rekeying than it's perfectly fine :).\n\nThanks for the answer!\n\nOn Mon, Jun 17, 2019 at 12:20 PM Jonas Schnelli \u003cdev at jonasschnelli.ch\u003e\nwrote:\n\n\u003e Hi Elichai\n\u003e\n\u003e \u003e About the nonce being 64bit. (rfc7539 changed it to 96bit, which djb\n\u003e later calls xchacha)\n\u003e \u003e\n\u003e \u003e You suggest that we use the \"message sequence number\" as the nonce for\n\u003e Chacha20, Is this number randomly generate or is this a counter?\n\u003e \u003e And could it be reseted without rekeying?\n\u003e\n\u003e The in BIP324 (v2 message transport protocol) proposed AEAD,\n\u003e ChaCha20Poly1305 at Bitcoin [1], uses a „message sequence number“. There is\n\u003e no such thing as random nonce described in the BIP (hence the term\n\u003e „sequence number“). The message sequence number starts with 0 and the max\n\u003e traffic before a rekey must occur is 1GB. A nonce/key reuse is conceptually\n\u003e impossible (of course implementations could screw up at this point).\n\u003e\n\u003e Using XChaCha20 with the possibility of a random nonce could be done, but\n\u003e I don’t see a reason to use it in our case since the usage of a sequence\n\u003e number as nonce seems perfectly save.\n\u003e\n\u003e [1]\n\u003e https://gist.github.com/jonasschnelli/c530ea8421b8d0e80c51486325587c52#chacha20-poly1305bitcoin-cipher-suite\n\u003e\n\n\n-- \nPGP: 5607C93B5F86650C\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20190617/d7cf1656/attachment-0001.html\u003e",
"sig": "da347937ef1ab84da84a66d45b1bdb2567a6e8d9a5c680dba99d1ec1c33653619b6e4b190b0c71df728f54929b029dd74525cb761594ea58f7d3ce44a3abd713"
}