Page MenuHomeFreeBSD

The ChaCha20 counter is little endian, not big endian.
ClosedPublic

Authored by jhb on Feb 17 2021, 10:32 PM.

Diff Detail

Repository
R10 FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

Hm, it is little endian, but I'm not confident about the two sentences prior.

In D28755#644005, @cem wrote:

Hm, it is little endian, but I'm not confident about the two sentences prior.

The variant in the kernel uses the 8/8 split. There are other variants however. libsodium has a xchacha variant that wireguard also uses (and I think that there are proposals to standardize in IETF for both IPsec and TLS) that uses a 24/4 split of nonce vs counter. If we add that in the future I would probably call it CRYPTO_XCHACHA20_POLY1305 to match the libsodium name.

Certainly not a regression :-)

This revision is now accepted and ready to land.Mar 3 2021, 5:04 AM