Re: [dm-crypt] some questions on dm-crypt/cryptsetup and LUKS2+integrity

[Arno Wagner <arno@wagner.name>]

On Tue, Sep 04, 2018 at 14:49:29 CEST, Christoph Anton Mitterer wrote:
> On Mon, 2018-09-03 at 09:48 +0200, Milan Broz wrote:
> > sorry for long delay, I was most of the time offline.
> Thanks, and no worries :-)
> 
> 
> > On 19/08/18 19:27, Christoph Anton Mitterer wrote:
> > > - ChaCha20 seems to have all 128 bit IV... but is this correct?
> > > I've
> > >   modpobed chacha20poly1305 ... but at least ther's no reference to
> > >   poly1305 in /proc/crypto
> > 
> > No, we use RFC7539 wrapper for Chacha20-poly1305 and here the nonce
> > is
> > only 96bit.
> > 
> > So the same probability of collision as in GCM, just a nonce
> > collision
> > does not cause such fatal failure as in GCM.
> 
> Are there any plans to provide ChaCha20/Poly1305 with larger nonces in
> the future?

I don't think that is a concern. 96bit, even if randomly chosen, 
is unlikely to collide in the remaining lifetime of this star-system.

Regards,
Arno

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier