[
https://issues.apache.org/jira/browse/SSHD-1017?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17141526#comment-17141526
]
Matt Sicker commented on SSHD-1017:
-----------------------------------
After letting this problem percolate, I think I've figured out the equivalence.
To match the same usage in OpenSSH, I think it would suffice to use the RFC
7539 form of ChaCha20-Poly1305 like so:
* Cipher initialized with a counter value of 0 and a nonce formed by four zero
bytes (the upper bytes of the counter in the pre-standard ChaCha) followed by
the eight-byte little endian encoding of the packet sequence number.
* This will initialize the Poly1305 mac appropriately and advance the counter
to 1 as OpenSSH specifies.
Everything else should hopefully fall into place here. The packet length
encryption/decryption uses the same nonce and a counter value of 0, but only
using ChaCha20 without authentication.
The biggest difference between this encoding and the previous AES/GCM one
(besides the packet length encryption) is how the initial nonce is constructed.
In AES/GCM, this starts with the generated IV from the handshake, then it
increments that value to correlate with the packet sequence number. In this new
ChaCha20-Poly1305 encoding, the generated IV is ignored entirely, and a fully
predictable nonce is created. The way that GCM is specified allows for using
that same strategy, but that isn't how it ended up being used in the standard.
> Add support for chacha20-poly1...@openssh.com
> ---------------------------------------------
>
> Key: SSHD-1017
> URL: https://issues.apache.org/jira/browse/SSHD-1017
> Project: MINA SSHD
> Issue Type: New Feature
> Reporter: Matt Sicker
> Priority: Major
>
> See [protocol
> details|https://github.com/openbsd/src/blob/master/usr.bin/ssh/PROTOCOL.chacha20poly1305].
> * [RFC 7539|https://tools.ietf.org/html/rfc7539] describes the
> ChaCha20-Poly1305 algorithm.
> The cipher is available in Java 11 natively and is also provided by
> Bouncycastle with a pure Java implementation fallback.
> As a bonus, this could potentially be adapted to propose an equivalent
> AES/GCM cipher encoding to how OpenSSH implements this ChaCha20-Poly1305
> cipher.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@mina.apache.org
For additional commands, e-mail: dev-h...@mina.apache.org
