Poly1305 is a universal hash family designed by Daniel J. Bernstein for use in cryptography.[1]

As with any universal hash family, Poly1305 can be used as a one-time message authentication code to authenticate a single message using a secret key shared between sender and recipient,[2] similar to the way that a one-time pad can be used to conceal the content of a single message using a secret key shared between sender and recipient.

Originally Poly1305 was proposed as part of Poly1305-AES,[3] a Carter–Wegman authenticator[4][5][1] that combines the Poly1305 hash with AES-128 to authenticate many messages using a single short key and distinct message numbers. Poly1305 was later applied with a single-use key generated for each message using XSalsa20 in the NaCl crypto_secretbox_xsalsa20poly1305 authenticated cipher,[6] and then using ChaCha in the ChaCha20-Poly1305 authenticated cipher[7][8][1] deployed in TLS on the internet.[9]

Description edit

Definition of Poly1305 edit

Poly1305 takes a 16-byte secret key   and an  -byte message   and returns a 16-byte hash  . To do this, Poly1305:[3][1]

  1. Interprets   as a little-endian 16-byte integer.
  2. Breaks the message   into consecutive 16-byte chunks.
  3. Interprets the 16-byte chunks as 17-byte little-endian integers by appending a 1 byte to every 16-byte chunk, to be used as coefficients of a polynomial.
  4. Evaluates the polynomial at the point   modulo the prime  .
  5. Reduces the result modulo   encoded in little-endian return a 16-byte hash.

The coefficients   of the polynomial  , where  , are:

 

with the exception that, if  , then:

 

The secret key   is restricted to have the bytes  , i.e., to have their top four bits clear; and to have the bytes  , i.e., to have their bottom two bits clear. Thus there are   distinct possible values of  .

Use as a one-time authenticator edit

If   is a secret 16-byte string interpreted as a little-endian integer, then

 

is called the authenticator for the message  . If a sender and recipient share the 32-byte secret key   in advance, chosen uniformly at random, then the sender can transmit an authenticated message  . When the recipient receives an alleged authenticated message   (which may have been modified in transmit by an adversary), they can verify its authenticity by testing whether

 
Without knowledge of  , the adversary has probability   of finding any   that will pass verification.

However, the same key   must not be reused for two messages. If the adversary learns

 

for  , they can subtract

 

and find a root of the resulting polynomial to recover a small list of candidates for the secret evaluation point  , and from that the secret pad  . The adversary can then use this to forge additional messages with high probability.

Use in Poly1305-AES as a Carter–Wegman authenticator edit

The original Poly1305-AES proposal[3] uses the Carter–Wegman structure[4][5] to authenticate many messages by taking   to be the authenticator on the ith message  , where   is a universal hash family and   is an independent uniform random hash value that serves as a one-time pad to conceal it. Poly1305-AES uses AES-128 to generate  , where   is encoded as a 16-byte little-endian integer.

Specifically, a Poly1305-AES key is a 32-byte pair   of a 16-byte evaluation point  , as above, and a 16-byte AES key  . The Poly1305-AES authenticator on a message   is

 

where 16-byte strings and integers are identified by little-endian encoding. Note that   is reused between messages.

Without knowledge of  , the adversary has low probability of forging any authenticated messages that the recipient will accept as genuine. Suppose the adversary sees   authenticated messages and attempts   forgeries, and can distinguish   from a uniform random permutation with advantage at most  . (Unless AES is broken,   is very small.) The adversary's chance of success at a single forgery is at most:

 

The message number   must never be repeated with the same key  . If it is, the adversary can recover a small list of candidates for   and  , as with the one-time authenticator, and use that to forge messages.

Use in NaCl and ChaCha20-Poly1305 edit

The NaCl crypto_secretbox_xsalsa20poly1305 authenticated cipher uses a message number   with the XSalsa20 stream cipher to generate a per-message key stream, the first 32 bytes of which are taken as a one-time Poly1305 key   and the rest of which is used for encrypting the message. It then uses Poly1305 as a one-time authenticator for the ciphertext of the message.[6]ChaCha20-Poly1305 does the same but with ChaCha instead of XSalsa20.[8]

Security edit

The security of Poly1305 and its derivatives against forgery follows from its bounded difference probability as a universal hash family: If   and   are messages of up to   bytes each, and   is any 16-byte string interpreted as a little-endian integer, then

 

where   is a uniform random Poly1305 key.[3]: Theorem 3.3, p. 8 

This property is sometimes called  -almost-Δ-universality over  , or  -AΔU,[10] where   in this case.

Of one-time authenticator edit

With a one-time authenticator  , the adversary's success probability for any forgery attempt   on a message   of up to   bytes is:

 

Here arithmetic inside the   is taken to be in   for simplicity.

Of NaCl and ChaCha20-Poly1305 edit

For NaCl crypto_secretbox_xsalsa20poly1305 and ChaCha20-Poly1305, the adversary's success probability at forgery is the same for each message independently as for a one-time authenticator, plus the adversary's distinguishing advantage   against XSalsa20 or ChaCha as pseudorandom functions used to generate the per-message key. In other words, the probability that the adversary succeeds at a single forgery after   attempts of messages up to   bytes is at most:

 

Of Poly1305-AES edit

The security of Poly1305-AES against forgery follows from the Carter–Wegman–Shoup structure, which instantiates a Carter–Wegman authenticator with a permutation to generate the per-message pad.[11] If an adversary sees   authenticated messages and attempts   forgeries of messages of up to   bytes, and if the adversary has distinguishing advantage at most   against AES-128 as a pseudorandom permutation, then the probability the adversary succeeds at any one of the   forgeries is at most:[3]

 

For instance, assuming that messages are packets up to 1024 bytes; that the attacker sees 264 messages authenticated under a Poly1305-AES key; that the attacker attempts a whopping 275 forgeries; and that the attacker cannot break AES with probability above δ; then, with probability at least 0.999999 − δ, all the 275 are rejected

— Bernstein, Daniel J. (2005)[3]

Speed edit

Poly1305-AES can be computed at high speed in various CPUs: for an n-byte message, no more than 3.1n + 780 Athlon cycles are needed,[3] for example. The author has released optimized source code for Athlon, Pentium Pro/II/III/M, PowerPC, and UltraSPARC, in addition to non-optimized reference implementations in C and C++ as public domain software.[12]

Implementations edit

Below is a list of cryptography libraries that support Poly1305:

See also edit

  • ChaCha20-Poly1305 – an AEAD scheme combining the stream cipher ChaCha20 with a variant of Poly1305

References edit

  1. ^ a b c d Aumasson, Jean-Philippe (2018). "Chapter 7: Keyed Hashing". Serious Cryptography: A Practical Introduction to Modern Encryption. No Starch Press. pp. 136–138. ISBN 978-1-59327-826-7.
  2. ^ Bernstein, Daniel J. (2008-05-01). "Protecting communications against forgery". In Buhler, Joe; Stevenhagen, Peter (eds.). Algorithmic number theory: lattices, number fields, curves and cryptography. Mathematical Sciences Research Institute Publications. Vol. 44. Cambridge University Press. pp. 535–549. ISBN 978-0521808545. Retrieved 2022-10-14.
  3. ^ a b c d e f g Bernstein, Daniel J. (2005-03-29). "The Poly1305-AES message-authentication code". In Gilbert, Henri; Handschuh, Helena (eds.). Fast Software Encryption: 12th international workshop. FSE 2005. Lecture Notes in Computer Science. Paris, France: Springer. doi:10.1007/11502760_3. ISBN 3-540-26541-4. Retrieved 2022-10-14.
  4. ^ a b Wegman, Mark N.; Carter, J. Lawrence (1981). "New Hash Functions and Their Use in Authentication and Set Equality". Journal of Computer and System Sciences. 22 (3): 265–279. doi:10.1016/0022-0000(81)90033-7.
  5. ^ a b Boneh, Dan; Shoup, Victor (January 2020). A Graduate Course in Applied Cryptography (PDF) (Version 0.5 ed.). §7.4 The Carter-Wegman MAC, pp. 262–269. Retrieved 2022-10-14.
  6. ^ a b Bernstein, Daniel J. (2009-03-10). Cryptography in NaCl (Technical report). Document ID: 1ae6a0ecef3073622426b3ee56260d34.
  7. ^ Nir, Y.; Langley, A. (May 2015). ChaCha20 and Poly1305 for IETF Protocols. doi:10.17487/RFC7539. RFC 7539.
  8. ^ a b Nir, Y.; Langley, A. (June 2018). ChaCha20 and Poly1305 for IETF Protocols. doi:10.17487/RFC8439. RFC 8439.
  9. ^ Langley, A.; Chang, W.; Mavrogiannopoulos, N.; Strombergson, J.; Josefsson, S. (June 2016). ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS). doi:10.17487/RFC7905. RFC 7905.
  10. ^ Halevi, Shai; Krawczyk, Hugo. "MMH: Software Message Authentication in the Gbit/Second Rates". In Biham, Eli (ed.). Fast Software Encryption. FSE 1997. Lecture Notes in Computer Science. Springer. doi:10.1007/BFb0052345. ISBN 978-3-540-63247-4.
  11. ^ Bernstein, Daniel J. (2005-02-27). "Stronger security bounds for Wegman-Carter-Shoup authenticators". In Cramer, Ronald (ed.). Advances in Cryptology—EUROCRYPT 2005, 24th annual international conference on the theory and applications of cryptographic techniques. EUROCRYPT 2005. Lecture Notes in Computer Science. Aarhus, Denmark: Springer. doi:10.1007/11426639_10. ISBN 3-540-25910-4.
  12. ^ A state-of-the-art message-authentication code on cr.yp.to

External links edit